All Apps and Add-ons

Yes, another person with Palo Alto dashboard issues...

BrendanCO
Path Finder

All,
I’m not getting consistent data within the dashboards and in some cases, no data in multiple dashboards within the Palo Alto App for Splunk. I could really use a sanity check!
To cover the basics:
• Followed the installation Debian Linux instructions step by step. All seemed to be good.
• Set up Splunk’s Data Input – UDP – 514 – pan:log
• Have my PAN FW’s forwarding syslog to my Splunk instance. Data seems to be coming in fine.
• To test I search for eventtype=pan and I’m getting good results.
My /opt/splunk/etc/apps/Splunk_TA_paloalto/default/inputs.conf looks like


[udp://514]
connection_host = ip
sourcetype = pan:log
no_appending_timestamp = true
disabled = 0


To make sure there weren’t conflicting inputs.conf I commented out: /opt/splunk/etc/apps /SplunkforPaloAltoNetworks/local/inputs.conf
I check the entire file structure and user:group for all apps is splunk:splunk

Thoughts?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!