All Apps and Add-ons

splunk app not parsing logfiles

Iwdavies
Path Finder

I'm sending my log files to splunk from a syslog server using a universal forwarder.  They are getting to the right index and the hostnames are being extracted fine.  The problem is, nothing else is parsing properly.  When I choose sourcetype=pan all i get is pan_log.  Its not parsing out the data into the appropriate types (i.e. threat, url, etc).  Here is a copy of my inputs.conf

[monitor://C:\Program Files (x86)\Syslogd\Logged Devices\]
host_segment = 5
sourcetype = "pan:log"
no_appending_timestamp=true
index=pan_logs
disabled = false

 

The source directory is formatted as follows:  

C:\Program Files (x86)\Syslogd\Logged Devices\PaloAlto Firewalls\%firewall model%\%ip_address%--Syslog-2021-01-21.txt

 

any thoughts?

 

Ian

Labels (2)
0 Karma

scelikok
Champion

@Iwdavies,

no_appending_timestamp option is valid only for UDP inputs. Since you are using syslog server, maybe parsing does no work because of timestamp addition or format.

Can you please post a few sample logs to check? 

 

If this reply helps you an upvote is appreciated.
0 Karma

Iwdavies
Path Finder

yes

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you installed a Palo Alto TA on your indexers?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

scelikok
Champion

Hi @Iwdavies,

Did you install Palo Alto Networks Add-on on indexers? Since you are using UF, sourcetype override will be done on indexers. 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on