All Apps and Add-ons
Highlighted

Palo Alto Networks App and Add-on for Splunk: Why is GlobalProtect traffic not showing up in dashboard or logs?

Path Finder

The Palo Alto Network App for Splunk seems to be working for traffic, threat and content but the GlobalProtect dashboard and log data are both blank.

I have no idea how to troubleshoot this.

I see the VPN traffic on the PAN firewall itself. All the policies that affect VPN are set to forward to Splunk.

0 Karma
Highlighted

Re: Palo Alto Networks App and Add-on for Splunk: Why is GlobalProtect traffic not showing up in dashboard or logs?

Contributor

Hi,

The Global Protect Dashboard gets informations from the system logs from the firewall. You can confirm you are sending system logs by searching for: sourcetype=pan:system

If you don't see any logs then you will need to go into the firewall and send system logs to Splunk.

Regards,

Paul

View solution in original post

Highlighted

Re: Palo Alto Networks App and Add-on for Splunk: Why is GlobalProtect traffic not showing up in dashboard or logs?

Path Finder

I changed the firewall to start sending system logs to Splunk

I now see GlobalProtect log data but the dashboard is still blank

0 Karma
Highlighted

Re: Palo Alto Networks App and Add-on for Splunk: Why is GlobalProtect traffic not showing up in dashboard or logs?

Contributor

From the Palo Alto Networks App go to Search and type in pan_globalprotect Do logs show up?

0 Karma
Highlighted

Re: Palo Alto Networks App and Add-on for Splunk: Why is GlobalProtect traffic not showing up in dashboard or logs?

Path Finder

looks like the dashboard took a little while to populate

everything is working now

thanks

0 Karma
Highlighted

Re: Palo Alto Networks App and Add-on for Splunk: Why is GlobalProtect traffic not showing up in dashboard or logs?

Contributor

Great! No problem glad I could help.

0 Karma