Getting Data In

can we use rsyslog instead of syslog-ng for palo alto app in splunk?

sairamvarma
New Member

hi

Can we use rsyslog instead of syslog-ng for palo alto app in splunk .when i read the palo alto guideliness for splunk they mentioned about syslog-ng ,my sourcetypes in palo alto are not transforming to threat:logs,traffic:logs so is my rsyslog is causing the problem.Kindly suggest me

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Yes, I'd be happy to help. I'm not sure how far you are in your syslog server configuration. I'll need more information, including what you are doing with your UF/HF.

View solution in original post

0 Karma

koshyk
Super Champion

if you can put the syslog-ng config, i can convert to rsyslog

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Yes, I'd be happy to help. I'm not sure how far you are in your syslog server configuration. I'll need more information, including what you are doing with your UF/HF.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I'm using rsyslog with Palo Alto data coming in and it is working with the PA app. So, YES, it will work.

0 Karma

sairamvarma
New Member

Hello cpetterborg

Could you please help me with the configuration ,so that i can fix my issue

0 Karma

lcastro
New Member

Where you are to get a working config?

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...