Getting Data In
Highlighted

Palo Alto App not doing sourcetype transform

Explorer

Hello

I have data being sent from Palo Alto to our syslog server. I have set it up following the guide here: https://splunk.paloaltonetworks.com/universal-forwarder.html

I now have also installed the Palo Alto add-on and the app. I have the data in splunk showing up as sourcetype = pan:log but none of the transforms are happening so therefor the app is not working.

What should I check to troubleshoot this?

Thanks.

0 Karma
Highlighted

Re: Palo Alto App not doing sourcetype transform

SplunkTrust
SplunkTrust

did you install the TA on Search Head and Indexer?

0 Karma
Highlighted

Re: Palo Alto App not doing sourcetype transform

Explorer

The search head and indexer are on the same server so yes!

0 Karma
Highlighted

Re: Palo Alto App not doing sourcetype transform

SplunkTrust
SplunkTrust

are you searching in verbose mode?
is the sourcetype transform happens than you supposed to see fields
on the link you posted:
https://splunk.paloaltonetworks.com/universal-forwarder.html
scroll down all the way to step 4 and verify

0 Karma
Highlighted

Re: Palo Alto App not doing sourcetype transform

Explorer

Yes I am searching in verbose mode
I have verified step four but the sourcetype transforms are not working.
I can search by the source and get "sourcetype=pan:log"

0 Karma
Highlighted

Re: Palo Alto App not doing sourcetype transform

Champion

First check whether the log is the source type.

index=your_index  sourcetype=pan*

It is other than "pan: log" if it is linked properly.

If the log is correctly captured and the screen is not displayed, the following causes may be considered.

· You are not accelerating the data model.
· The original log is customized.

0 Karma