All Apps and Add-ons

Yes, another person with Palo Alto dashboard issues...

BrendanCO
Path Finder

All,
I’m not getting consistent data within the dashboards and in some cases, no data in multiple dashboards within the Palo Alto App for Splunk. I could really use a sanity check!
To cover the basics:
• Followed the installation Debian Linux instructions step by step. All seemed to be good.
• Set up Splunk’s Data Input – UDP – 514 – pan:log
• Have my PAN FW’s forwarding syslog to my Splunk instance. Data seems to be coming in fine.
• To test I search for eventtype=pan and I’m getting good results.
My /opt/splunk/etc/apps/Splunk_TA_paloalto/default/inputs.conf looks like


[udp://514]
connection_host = ip
sourcetype = pan:log
no_appending_timestamp = true
disabled = 0


To make sure there weren’t conflicting inputs.conf I commented out: /opt/splunk/etc/apps /SplunkforPaloAltoNetworks/local/inputs.conf
I check the entire file structure and user:group for all apps is splunk:splunk

Thoughts?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...