The Firewall Palo Alto logs cannot be parsed using Splunk Add-on for Palo Alto Networks

[nooproblems]

Hi all,

I’m having an issue with parsing Palo Alto Firewall logs in Splunk. Here is the current situation:
- I configured the Palo Alto firewall logs to be sent to the Splunk HF via UDP port 514.

- I installed the Splunk Add-on for Palo Alto Networks on the deployment server and pushed the TA to the HF, indexers, and search head.
- However, the Palo Alto logs in Splunk are still not being parsed. I currently don’t have a clear direction for troubleshooting. I would appreciate any advice or experience the community can share.
@palo alto

[PrewinThomas]

@nooproblems 

Since you already have add-ons everywhere, does your event include a syslog header? Could you provide a sample log?
To ensure the Palo Alto add-on functions properly, make sure the syslog header is not included in your log.

If you have syslog header add below to your inputs.conf

no_appending_timestamp = true

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[inventsekar]

 I installed the Splunk Add-on for Palo Alto Networks on the deployment server and pushed the TA to the HF, indexers, and search head.

---

from DS, did you push the TA to indexers and search heads?