All Apps and Add-ons

Palo Alto Networks App/Add-on not showing data with custom index

darizotas
New Member

Platform: Splunk and Palo Alto Networks App/Add-on latest release.

Following the installation instructions it looks like you can configure the Palo Alto Networks App/Add-on to a custom index. If I perform a search: index=my_custom_index eventtype=pan within the Add-On, it works. Without indicating the index, it does not.

On top of that the App is unable to populate the dashboards. I have added the local/inputs.conf to the App and Add-on with the configuration:

App version 5.x/6.x with Add-on

[udp://514]
connection_host = ip
index = network
sourcetype = pan:log
no_appending_timestamp = true

But no luck. Has anyone experienced something similar?

Thanks,
D

0 Karma

darizotas
New Member

@micahkemp, you are in the right track. I found this pull request in the Github repo of the application that points to the solution (still under development):

https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/pull/15

Thanks for answering!

0 Karma

micahkemp
Champion

It sounds like your custom index is not included in the list of indexes to search by default. Refer to the documentation to look into how this can be changed.

Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...