Palo Alto Networks App and Add-on for Splunk: Why is GlobalProtect traffic not showing up in dashboard or logs?

[heathramos]

The Palo Alto Network App for Splunk seems to be working for traffic, threat and content but the GlobalProtect dashboard and log data are both blank.

I have no idea how to troubleshoot this.

I see the VPN traffic on the PAN firewall itself. All the policies that affect VPN are set to forward to Splunk.

[panguy · Accepted solution]

Hi,

The Global Protect Dashboard gets informations from the system logs from the firewall. You can confirm you are sending system logs by searching for: sourcetype=pan:system

If you don't see any logs then you will need to go into the firewall and send system logs to Splunk.

Regards,

Paul

[heathramos]

I changed the firewall to start sending system logs to Splunk

I now see GlobalProtect log data but the dashboard is still blank

[panguy]

From the Palo Alto Networks App go to Search and type in pan_globalprotect Do logs show up?

[heathramos]

looks like the dashboard took a little while to populate

everything is working now

thanks

[panguy]

Great! No problem glad I could help.