All,
I’m not getting consistent data within the dashboards and in some cases, no data in multiple dashboards within the Palo Alto App for Splunk. I could really use a sanity check!
To cover the basics:
• Followed the installation Debian Linux instructions step by step. All seemed to be good.
• Set up Splunk’s Data Input – UDP – 514 – pan:log
• Have my PAN FW’s forwarding syslog to my Splunk instance. Data seems to be coming in fine.
• To test I search for eventtype=pan and I’m getting good results.
My /opt/splunk/etc/apps/Splunk_TA_paloalto/default/inputs.conf looks like
[udp://514]
connection_host = ip
sourcetype = pan:log
no_appending_timestamp = true
disabled = 0
To make sure there weren’t conflicting inputs.conf I commented out: /opt/splunk/etc/apps /SplunkforPaloAltoNetworks/local/inputs.conf
I check the entire file structure and user:group for all apps is splunk:splunk
Thoughts?
