PaloAlto Threat and Traffic logs not being passed to splunk but System and Config logs are.

[RichieOl]

We are testing the log collection from our paloalto firewalls and seem to have come across a snag when trying to monitor the traffic and threat events. We have the PaloAlto addon and app installed and it is working fine as the config and system logs are being processed and added to the dashboard. The datamodel accelaration is on but there is still no data.

When using the search bar i have been looking for all logs coming in through port 514 as the logs are being send through udp. (source=udp:514) and i can see the system and config logs there too but no other types. I am starting to feel like the issue is with the palo side but i want to make sure that i am not missing something on the splunk side to. Ive gone through the log forwarding form the palo side several times and if its sending the system and config fine, why not the rest? KR

[RichieOl · Accepted solution]

Found the solution. I had created the forwarding profile for the traffic and threat logs and set the forwarding to the splunk server but i didnt attach it to the security policy i wanted to monitor so i was onyl getting the standard config and systems logs that monitor the fw itself, not the data that is getting passed through.

Here is the knowledge article i found that helped me resolve my issue if anyone has a similar problem in the future.

Tips & Tricks: Forward traffic logs to a syslog server - Knowledge Base - Palo Alto Networks