All Apps and Add-ons

Question about Palo Alto Network

New Member

Dear Splunkers,
I have installed Splunk for Palo Alto Network app, Do you have a manual how to install. Should I have to configure syslog on Palo Alto Device?


Jose Rivera

0 Karma


Hello Jose,

There are instructions on the apps page. Short version, you will have to configure your Palo Alto firewall to forward to a Splunk sever. On the Splunk side, you will have to configure an input. The readme file in the apps directory has a sample inputs.conf stanza.



(Typing with thumbs)

lets say that the PaloAlto is sending logs to UDP 5155 (the default is udp 514), here's a sample stanza for your inputs.conf


index= pan_logs

connection_host = ip

sourcetype = pan_log

no_appending_timestamp = true