Theres no data shown in the app.
Do I configure the inputs.conf at /opt/splunk/etc/apps/SplunkforPaloAltoNetworks/local or /opt/splunk/etc/system/local ?
I'm currently taking in the logs already and sourcetype as syslog.
Here's my config for inputs.conf
connection_host = ip1|ip2
sourcetype = pan_log
no_appending_timestamp = true
Anything I've missed?
I might be a little late for an answer but I just came across this issue today because we just started setting up our PAs.
My solution was to modify the macros.conf file located here $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/default/macros.conf.
The portion of the conf file I modified are below:
definition = index=indexname sourcetype="pan_threat" NOT "THREAT,url"
definition = index=indexname sourcetype="pan_traffic"
definition = index=indexname sourcetype="pan_system"
definition = index=indexname sourcetype="pan_config"
definition = index=indexname sourcetype="pan_threat" "THREAT,url"
You'll notice that in your macros.conf file you won't have the index specified.
Hopefully this helps or at least helps others that come across this issue in the future.
Adding the index=Indexname statement fixed my issue.
I seem to be collecting some pan_system logs after place the config.However the host field isn't reflecting the actual pan device ip.How should I amend it?