Palo Alto App not doing sourcetype transform

[xxkenta]

Hello

I have data being sent from Palo Alto to our syslog server. I have set it up following the guide here: https://splunk.paloaltonetworks.com/universal-forwarder.html

I now have also installed the Palo Alto add-on and the app. I have the data in splunk showing up as sourcetype = pan:log but none of the transforms are happening so therefor the app is not working.

What should I check to troubleshoot this?

Thanks.

[HiroshiSatoh]

First check whether the log is the source type.

index=your_index  sourcetype=pan*

It is other than "pan: log" if it is linked properly.

If the log is correctly captured and the screen is not displayed, the following causes may be considered.

· You are not accelerating the data model.
· The original log is customized.

[adonio]

did you install the TA on Search Head and Indexer?

[xxkenta]

The search head and indexer are on the same server so yes!

[adonio]

are you searching in verbose mode?
is the sourcetype transform happens than you supposed to see fields
on the link you posted:
https://splunk.paloaltonetworks.com/universal-forwarder.html
scroll down all the way to step 4 and verify

[xxkenta]

Yes I am searching in verbose mode
I have verified step four but the sourcetype transforms are not working.
I can search by the source and get "sourcetype=pan:log"

[quinneyc]

Greetings @xxkenta 

Were you ever able to find a viable solution for this issue?  I'm having a similar situation.