All Apps and Add-ons

Palo Alto Networks App/Add-on not showing data with custom index

darizotas
New Member

Platform: Splunk and Palo Alto Networks App/Add-on latest release.

Following the installation instructions it looks like you can configure the Palo Alto Networks App/Add-on to a custom index. If I perform a search: index=my_custom_index eventtype=pan within the Add-On, it works. Without indicating the index, it does not.

On top of that the App is unable to populate the dashboards. I have added the local/inputs.conf to the App and Add-on with the configuration:

App version 5.x/6.x with Add-on

[udp://514]
connection_host = ip
index = network
sourcetype = pan:log
no_appending_timestamp = true

But no luck. Has anyone experienced something similar?

Thanks,
D

0 Karma

darizotas
New Member

@micahkemp, you are in the right track. I found this pull request in the Github repo of the application that points to the solution (still under development):

https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/pull/15

Thanks for answering!

0 Karma

micahkemp
Champion

It sounds like your custom index is not included in the list of indexes to search by default. Refer to the documentation to look into how this can be changed.

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...