All Apps and Add-ons

splunk app not parsing logfiles

Iwdavies
Path Finder

I'm sending my log files to splunk from a syslog server using a universal forwarder.  They are getting to the right index and the hostnames are being extracted fine.  The problem is, nothing else is parsing properly.  When I choose sourcetype=pan all i get is pan_log.  Its not parsing out the data into the appropriate types (i.e. threat, url, etc).  Here is a copy of my inputs.conf

[monitor://C:\Program Files (x86)\Syslogd\Logged Devices\]
host_segment = 5
sourcetype = "pan:log"
no_appending_timestamp=true
index=pan_logs
disabled = false

 

The source directory is formatted as follows:  

C:\Program Files (x86)\Syslogd\Logged Devices\PaloAlto Firewalls\%firewall model%\%ip_address%--Syslog-2021-01-21.txt

 

any thoughts?

 

Ian

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

@Iwdavies,

no_appending_timestamp option is valid only for UDP inputs. Since you are using syslog server, maybe parsing does no work because of timestamp addition or format.

Can you please post a few sample logs to check? 

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Iwdavies
Path Finder

yes

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you installed a Palo Alto TA on your indexers?

---
If this reply helps you, Karma would be appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Iwdavies,

Did you install Palo Alto Networks Add-on on indexers? Since you are using UF, sourcetype override will be done on indexers. 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...