hi
Can we use rsyslog instead of syslog-ng for palo alto app in splunk .when i read the palo alto guideliness for splunk they mentioned about syslog-ng ,my sourcetypes in palo alto are not transforming to threat:logs,traffic:logs so is my rsyslog is causing the problem.Kindly suggest me
Yes, I'd be happy to help. I'm not sure how far you are in your syslog server configuration. I'll need more information, including what you are doing with your UF/HF.
if you can put the syslog-ng config, i can convert to rsyslog
Yes, I'd be happy to help. I'm not sure how far you are in your syslog server configuration. I'll need more information, including what you are doing with your UF/HF.
I'm using rsyslog with Palo Alto data coming in and it is working with the PA app. So, YES, it will work.
Hello cpetterborg
Could you please help me with the configuration ,so that i can fix my issue
Where you are to get a working config?