Getting Data In

Palo Alto App


Hi All

Hoping someone can help me, I am trying to get the Palo Alto App working we are a Splunk cloud customer and have this app on our search-head 


When I search for eventype=pan I see the logs but they are NOT reclassified


Our set up is we have our Palo Alto firewalls pushing to a syslog server on standard port 514, this data at the moment is currently being ingested as one syslog stream via universal forwarder, where the sourcetype=syslog and index=syslog. 


In inputs.conf in


/opt/splunk/etc/system/local I have configured the below



index = pan_logs

sourcetype = pan:log

host_segment = 3



The guide states to configure your TCP outputs in 


/ opt/splunkforwarder/etc/system/local/outputs.conf in this file we have 


indexAndForward = 1


As a cloud customer we have our company app in root@syslog:/opt/splunk/etc/apps/OUR_COMPANY_APP/default


The outputs.conf has but no input file,,


The input file being used is




The PaloAlto app states to add your indexers to Create or modify/opt/splunkforwader/etc/system/local/outputs.conf 


and add a tcpout stanza: 


Could I copy over the outputs from root@syslog:/opt/splunk/etc/apps/OUR_COMPANY_APP/default to /opt/splunkforwader/etc/system/local/outputs.conf


Labels (1)
0 Karma