Using SplunkCloud, we have version 6.1.1 of both the App and the Add-on installed.
I'm seeing that Palo Alto logs aren't getting the host field set correctly. Everything else seems to be parsed correctly.
We're receiving the data, forwarded using the Log Forwarding App for Cortex. Upon receiving the data, we're extracting the time and host name from the raw syslog event, and sending it to Splunk using the HEC input (using the extracted time as value to _time, extracted host name as host and the raw syslog event, as received by Cortex, as event).
Initially, we thought that we'd be able to extract the host name easily, as syslog is pretty clear about what field it should appear in. Unfortunately, when data is forwarded from Cortex, the instance on which the Log Forwarder is running is written to the host field.
Thus, by parsing the syslogs for host name and setting it in the Splunk HEC data, we're effectively setting the same host field for every log (logforwarder-somethingsenseless).
Given that Cortex apparently doesn't send the raw events, I would have assumed that the Splunk Add-on or TA would parse and rewrite the host field, but that isn't the case.
Is our setup of Cortex->Syslog->HEC not supported or is there something else we need to (re)configure in order for Splunk to set the correct host field?
Edit: After looking through the App and Add-on source, I don't see the host field being set anywhere.
