All Apps and Add-ons

Palo Alto Networks App/Add-on not showing data with custom index

darizotas
New Member

Platform: Splunk and Palo Alto Networks App/Add-on latest release.

Following the installation instructions it looks like you can configure the Palo Alto Networks App/Add-on to a custom index. If I perform a search: index=my_custom_index eventtype=pan within the Add-On, it works. Without indicating the index, it does not.

On top of that the App is unable to populate the dashboards. I have added the local/inputs.conf to the App and Add-on with the configuration:

App version 5.x/6.x with Add-on

[udp://514]
connection_host = ip
index = network
sourcetype = pan:log
no_appending_timestamp = true

But no luck. Has anyone experienced something similar?

Thanks,
D

0 Karma

darizotas
New Member

@micahkemp, you are in the right track. I found this pull request in the Github repo of the application that points to the solution (still under development):

https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/pull/15

Thanks for answering!

0 Karma

micahkemp
Champion

It sounds like your custom index is not included in the list of indexes to search by default. Refer to the documentation to look into how this can be changed.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...