Splunk_TA_paloalto not parsing the logs

[jibin1988]

Splunk_TA_paloalto is not parsing the logs :

inputs.conf :

[monitor:///data/splunkapp/syslog/MSSLCPRY01/paloalto_fw//.log]
sourcetype = pan:log
index = it
host_segment = 6
disabled = false

Is it mandatory to keep the index pan_log?

Palo alto logs are sending to syslog server/HF and TA installed on syslog/HF.

Can someone please help whats going wrong in this.

[sumanssah]

Please try this

inputs.conf :

[monitor:///data/splunkapp/syslog/MSSLCPRY01/paloalto_fw/
 *.log        ]
sourcetype = pan:log
index = it
host_segment = 6
disabled = false

Yes can send Paloalto logs to any index, make sure you are sending logs to pan:log

https://splunk.paloaltonetworks.com/firewalls-panorama-and-traps.html

[jibin1988]

Hi @sumanssah ,

My inputs.conf is same as you mentioned and sourcetype is pan:log :
monitoring path is correct.

[monitor:///data/splunkapp/syslog/MSSLCPRY01/paloalto_fw//.log]
sourcetype = pan:log
index = it
host_segment = 6
disabled = false

[jibin1988]

Question is, I am searching for index=it sourcetype=pan* in search app.
will the parsing works for search app as well? OR we must use paloalto addon for searching?

[harsmarvania57]

Hi,

You can index data in any index.

Please install Splunk_TA_paloalto on Search Heads so that it will parse data properly.

[jibin1988]

@harsmarvania57 Thanks for the input. Its installed in Search Heads as well.

[harsmarvania57]

After data is indexed, what sourcetype you can see from searchhead for paloalto logs ?

[jibin1988]

i can see below sourcetypes:

pan:traffic
pan:threat
pan:system

[harsmarvania57]

That means HF is parsing data properly. Can you please check Splunk_TA_paloalto add-on permission on SH, it should be Global - Read to everyone

[jibin1988]

@harsmarvania57 Permission is Global. But issue here is there no src_ip, dst_ip etc. And in search app my log looks like below:

< 14 >Feb 18 07:54:52 FWRY95-IT-RDC46-F1-WA-A10-01 1,2020/02/18 07:54:52,012501002982,TRAFFIC,drop,2049,2020/02/18 07:54:52,192.168.99.50,10.21.64.18,0.0.0.0,0.0.0.0,interzone-default,,,not-applicable,vsys1,Outside,FWasGW-2001,ae1.2000,,LOG-FOR,2020/02/18

Its looks like the timestamp issue i think.