All Apps and Add-ons

Palo Alto logs + Syslog not showing up Palo Alto Add-On

tentontitan
New Member

I'm currently collecting Palo Alto traffic via Syslog. I'm then shooting it up to a single indexer that has both the Palo Alto App & Add-On.

[monitor:palo_logs.log]
sourcetype = pan:log
source = syslog
host = x.x.x.x
disabled = false
interval = 600    

While I can search through the data as though it were any other Splunk log, the Palo Alto APP & Add-On are not recognizing or transforming the data. Meaning I do not see any events or dashboards in those apps.

Also the sourcetype = pan:log in splunk. However the documentation specifies other source types:

Palo Alto Add-On Documentation

If someone can help me determine what I'm doing wrong, I would appreciate.

0 Karma

Eric_Mcknight
Explorer

Thanks to validate:

  1. Make sure the add-on is installed on your forwarder.
  2. Me personally, i install the app and add-on on my HEAVY forwarder syslog server, and don't install it on my indexers. Actually reduces indexer load by quite a bit.
  3. Make sure the app and add-on are installed on your search head.
0 Karma

tentontitan
New Member

Interesting. I'm currently using a universal forwarder to send data to Splunk. But you're saying that won't work. And that I have to use the heavy forwarder to forward and send the data properly. That way the transformations take place on the heavy forwarder and send it to your indexer.

I'll need to experiment.

0 Karma

Eric_Mcknight
Explorer

Things to check:

  1. Configuration looks just fine.
  2. Make sure the add-on is installed on your forwarder.
  3. Make sure the APP and Add-on are installed on your search heads.
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...