Getting Data In

Palo Alto App not doing sourcetype transform

xxkenta
Explorer

Hello

I have data being sent from Palo Alto to our syslog server. I have set it up following the guide here: https://splunk.paloaltonetworks.com/universal-forwarder.html

I now have also installed the Palo Alto add-on and the app. I have the data in splunk showing up as sourcetype = pan:log but none of the transforms are happening so therefor the app is not working.

What should I check to troubleshoot this?

Thanks.

0 Karma

HiroshiSatoh
Champion

First check whether the log is the source type.

index=your_index  sourcetype=pan*

It is other than "pan: log" if it is linked properly.

If the log is correctly captured and the screen is not displayed, the following causes may be considered.

· You are not accelerating the data model.
· The original log is customized.

0 Karma

adonio
Ultra Champion

did you install the TA on Search Head and Indexer?

0 Karma

xxkenta
Explorer

The search head and indexer are on the same server so yes!

0 Karma

adonio
Ultra Champion

are you searching in verbose mode?
is the sourcetype transform happens than you supposed to see fields
on the link you posted:
https://splunk.paloaltonetworks.com/universal-forwarder.html
scroll down all the way to step 4 and verify

0 Karma

xxkenta
Explorer

Yes I am searching in verbose mode
I have verified step four but the sourcetype transforms are not working.
I can search by the source and get "sourcetype=pan:log"

0 Karma

quinneyc
Engager

Greetings @xxkenta 

Were you ever able to find a viable solution for this issue?  I'm having a similar situation.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...