Getting Data In

Palo Alto Syslog being Indexed, but not parsed

cklinkbeil
New Member

I saw the other forum posts, and they are not the same Issue i am having. I have configured the PA to directly send syslog's to the Splunk server. Its a single node deployment. I installed the Addon as well as the PA dashboard app. I am using the default syslog format of BSD with no custom formats.

I created a Pan_logs Index and a UDP data input on 5514, with a sourcetype of pan:log. I have also tried other source types such as pan:firewall, pan:traffic....etc

I can do a search on the index, and it comes up with all the syslog messages. The source type is pan:traffic from most of them. config changes come in with pan:config.

The index is configured with the App of the Addon

None of the data is being parsed into the dashboard. A search of eventtype="pan_firewall" yields no results.

What am I missing? I feel like its a Splunk config i need.

Tags (1)
0 Karma

cklinkbeil
New Member

To add to what I typed previously, when I search the index, it looks like the "sourcetype" is not being converted from "pan:config" to "pan_config"

all of the source types still have the ":" in them.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...