I have data being sent from Palo Alto to our syslog server. I have set it up following the guide here: https://splunk.paloaltonetworks.com/universal-forwarder.html
I now have also installed the Palo Alto add-on and the app. I have the data in splunk showing up as sourcetype = pan:log but none of the transforms are happening so therefor the app is not working.
What should I check to troubleshoot this?
are you searching in
is the sourcetype transform happens than you supposed to see fields
on the link you posted:
scroll down all the way to step 4 and verify
Yes I am searching in verbose mode
I have verified step four but the sourcetype transforms are not working.
I can search by the source and get "sourcetype=pan:log"
First check whether the log is the source type.
It is other than "pan: log" if it is linked properly.
If the log is correctly captured and the screen is not displayed, the following causes may be considered.
· You are not accelerating the data model.
· The original log is customized.