PaloAlto logs ingested and Paloalto app does not "see" them

[corti77]

Hi, 

quick summary of our deployment:

- Splunk standalone 9.0.6

- PaloAlto Add-on and App freshly installed 8.1.0

- SC4S v3.4.4 sending logs to splunk

- PA logs ingested in indexes and sourcetypes according SC4S official doc
https://splunk.github.io/splunk-connect-for-syslog/main/sources/vendor/PaloaltoNetworks/panos/

- I see events in all indexes and with all sourcetypes.

Indexes: netfw, netproxy, netauth, netops

Sourcetypes: pan:traffic , pan:threat , pan:userid, pan:system, pan:globalprotect, pan:config

What else do I need to do to make the official PaloAlto App to work?

I checked the documentation https://pan.dev/splunk/docs/installation/  and I enable the data acceleration, and still no data is shown in any dashboard. I don't know what else is missing, any suggestion?

thanks a lot

[_JP]

Have you checked the Troubleshooting section of their docs?  There's some searches they have you run to see if your time settings are off. 

If the visualizations aren't rendering anything, try seeing what search they are running (hover over viz to get the little magnifying class to see the search being ran).  Digging into that SPL a bit might give you a hint on what could be wrong.

Also, if you *ust* turned on the data models there might be some lag before those behind-the-scenes things create the models from your data.  Much of that is dependent on how Palo Alto created their models and I'm not familiar with the timing of their stuff.

[corti77]

thanks @_JP .

I checked that link and what I saw is that if I search for eventtype=pan I get 0 results but if I include 
index=* eventtype=pan, then I get thousands of events.

So I can imagine that the Palolato app does not include the indexes in its searches.

Do you know if I should include the indexes to use some where in the local folder? or maybe there is a setting in splunk to user index=* by default in any search that does not include the index clause?

cheers

[corti77]

UPDATE:
I just edited the datamodel and included the related indexes. Waiting for the index now to be recalculated.
I will let you know if that solves the issue.