Issue with Palo Alto apps

[gskorski]

I have an issue with the Palo Alto apps.
It seems that the transforms doesn't work.
I can see my Palo Alto logs in the search apps but nothing in the Palo Alto apps.
I'm running the latest version 1.2.0 and Splunk v4.3.

Can you help me?

[willthames2]

We have the exact same problem. Interesting to know if anyone has a solution. sourcetype=pan_log finds lots of logs containing the regex ,TRAFFIC, as per transforms.conf

[gskorski]

The issue is that the sourcetype is not renamed. So the application doesn't find any logs.

[MarioM]

This rename expect to find THREAT,TRAFFIC,CONFIG,SYSTEM, keywords in your Palo Alto data

And origin sourcetype need to be pan_log

[MarioM]

As Splunk indexes your Palo Alto Networks firewall data, the app will rename the sourcetypes to pan_threat, pan_traffic, pan_config, and pan_system depending on the logging facility in your firewall.

This rename expect to find THREAT,TRAFFIC,CONFIG,SYSTEM, keywords in your Palo Alto data

And origin sourcetype need to be pan_log

[gskorski]

I know that.

The sourcetype is well configured as pan_log, and I can find THREAT, TRAFFIC, CONFIG and SYSTEM keyword in the logs but the app doesn't display anything.