All Apps and Add-ons

configuring data for splunk palo alto


Theres no data shown in the app.

Do I configure the inputs.conf at /opt/splunk/etc/apps/SplunkforPaloAltoNetworks/local or /opt/splunk/etc/system/local ?

I'm currently taking in the logs already and sourcetype as syslog.

Here's my config for inputs.conf
connection_host = ip1|ip2
sourcetype = pan_log
no_appending_timestamp = true

Anything I've missed?

0 Karma


I might be a little late for an answer but I just came across this issue today because we just started setting up our PAs.

My solution was to modify the macros.conf file located here $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/default/macros.conf.

The portion of the conf file I modified are below:

Base Macros
definition = index=indexname sourcetype="pan_threat" NOT "THREAT,url"

definition = index=indexname sourcetype="pan_traffic"

definition = index=indexname sourcetype="pan_system"

definition = index=indexname sourcetype="pan_config"

definition = index=indexname sourcetype="pan_threat" "THREAT,url"

You'll notice that in your macros.conf file you won't have the index specified.

Hopefully this helps or at least helps others that come across this issue in the future.


Adding the index=Indexname statement fixed my issue.


0 Karma


I seem to be collecting some pan_system logs after place the config.However the host field isn't reflecting the actual pan device ip.How should I amend it?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!