Splunk for Palo Alto App - Peer Splunk Indexers

[scottroymcse]

We've recently started to change our splunk topology from a single search head / indexer, to search head and remote peer indexers.

The PAN splunk app will stay installed on the search head, however now with the traffic going to the indexers, all traffic is indexed as pan_log, however I recall a transforms.conf file that was setup in the application that would use some regex values to split up the traffic / threat / system traffic into different sourcetypes (?).

How is the PAN app supposed to work in this type of topology? Do I need to install the app on each of the indexers and have the transforms.conf copied over from the search head (original install point)?

[kskujawa]

I installed the app on my indexer as well and can get the overview dashboard just fine, other dashboards such as Wildfire, Threat and Content are not working.

From the search head:
[REMOTE-INDEXER] The search for datamodel 'pan_logs' failed to parse, cannot get indexes to search

[Ayn]

Easiest is to just put the full app on both the indexers and your search head. As you mention yourself, there are index-time transforms in the app that need to go on the indexer. While you could of course break them out, the other stuff in the app isn't really causing any harm so the easiest (especially with regards to possible future updates of the app) is to just put the app as-is everywhere.

[scottroymcse]

Thanks for the response. After some investigation, it was better to take to transforms and props and bundled them into an application and deployed the files to the indexers. If I add additional indexers in the future, these changes will be pushed out automagically ..