Palo Alto's Netflow data not showing up in Splunk 5.0.1 via Netflow Integrator 3.1

[jtc242]

I have a Palo Alto server running PANOS 5.0.1 that is sending netflow data to Netflow Integrator 3.1 on Splunk 5.0.1. I have sniffed traffic on port 9995 on eth0 of the splunk box but do not see netflow's syslog on port 11514 for either lo or eth0. Splunk is running on Centos 5.5 32bit. I thought perhaps there was an issue with the linux binary for Netflow Intergrator so I tried installing a fresh splunk and Netflow Integrator on a windows 2008 server. I am seeing the same issue. No data is showing up in the app and the netflow_si_traffic index is empty. I then installed another netflow analyzer on the same windows box on port 9996 and changed the Palo Alto box to send to that port instead. It works perfectly. Does anyone know if the Palo Alto Netflow is non standard in some way? Is there anyway I could check? Any other thoughts on what might be going on here?

thanks

-jeff

[dmiller2010]

Hi Jeff,

We will be supporting Palo Alto Networks flow in our Standard Edition, not on our free edition, which is what you are using. (We expect to release it in February) If you would like to provide some input on the possible output screens for Splunk, please submit a Feature Request at: https://netflowlogic.zendesk.com/home it would be great to get your insights!