Can Palo Alto logs be sent directly to Splunk, or do they initially need to be sent first to a syslog server ?

[adnankhan5133]

I'm wondering if it's possible to configure the Palo Alto log forwarding profile so that the PA logs are directly sent to the Splunk indexers, or if we need to follow the traditional route of Palo Alto ---> syslog server (w/ Splunk Universal Forwarder) ---> Splunk indexers.

[richgalloway]

Yes, it is possible to send PA logs directly to Splunk - it's just not advised. See http://www.georgestarcher.com/splunk-success-with-syslog/ for a good explanation.