can we use rsyslog instead of syslog-ng for palo alto app in splunk?

[sairamvarma]

hi

Can we use rsyslog instead of syslog-ng for palo alto app in splunk .when i read the palo alto guideliness for splunk they mentioned about syslog-ng ,my sourcetypes in palo alto are not transforming to threat:logs,traffic:logs so is my rsyslog is causing the problem.Kindly suggest me

[koshyk]

if you can put the syslog-ng config, i can convert to rsyslog

[cpetterborg · Accepted solution]

Yes, I'd be happy to help. I'm not sure how far you are in your syslog server configuration. I'll need more information, including what you are doing with your UF/HF.

[cpetterborg]

I'm using rsyslog with Palo Alto data coming in and it is working with the PA app. So, YES, it will work.

[sairamvarma]

Hello cpetterborg

Could you please help me with the configuration ,so that i can fix my issue

[lcastro]

Where you are to get a working config?