Initially, I was just planning to install the Palo Alto Network Add-on for Splunk on an HF, and get the traffic and threat logs sent to Splunk, but there also appears to be a lot of documentation for using a syslog server + UF to facilitate the flow of Palo Alto logs to Splunk.
What is the recommended approach to send Palo Alto logs to Splunk? I'm mainly interested in just getting firewall (pan:traffic) and IDS/IPS (pan:threat) logs.
