Can we use rsyslog instead of syslog-ng for palo alto app in splunk .when i read the palo alto guideliness for splunk they mentioned about syslog-ng ,my sourcetypes in palo alto are not transforming to threat:logs,traffic:logs so is my rsyslog is causing the problem.Kindly suggest me
I'm using rsyslog with Palo Alto data coming in and it is working with the PA app. So, YES, it will work.
Could you please help me with the configuration ,so that i can fix my issue
Yes, I'd be happy to help. I'm not sure how far you are in your syslog server configuration. I'll need more information, including what you are doing with your UF/HF.