Splunk for Palo Alto Networks: What are the requirements to populate Wildfire data in Splunk?

[virek2003]

I am current receiving other dashboards except for wildfire. That one is empty. I ran a search for the wildfire sourcetype and it was empty.

I have loaded the API key in the configuration.

What else is there to do? An additional log to send on the Palo? Where does it grab this info from? Port requirements?

[pickerin]

I spoke with Brian Torres-Gil today at Splunk .conf2015. I asked him this exact question.
He said that Wildfire logs have to be sent to PAN separately from the stock logs. Unfortunately, I haven't yet figured out how to do this and none of the documentation mentions it, but at least it's a start.

He also said you only need the API key to submit items to Wildfire, you don't need it to populate the dashboards. The missing piece is actually sending the logs in.

[pickerin]

Well, I found my issue, and it wasn't bringing in additional logs.

By default, the dashboard is set to "Last 60 minutes". I changed it to "Today" and data populated.

You can also confirm operation by going to Palo Alto application, then click "Search" and enter pan_wildfire, surrounded by backticks (by the tilde). You should see some hits, based on the time frame you select.