Getting Data In
Highlighted

can we use rsyslog instead of syslog-ng for palo alto app in splunk?

New Member

hi

Can we use rsyslog instead of syslog-ng for palo alto app in splunk .when i read the palo alto guideliness for splunk they mentioned about syslog-ng ,my sourcetypes in palo alto are not transforming to threat:logs,traffic:logs so is my rsyslog is causing the problem.Kindly suggest me

0 Karma
Highlighted

Re: can we use rsyslog instead of syslog-ng for palo alto app in splunk?

SplunkTrust
SplunkTrust

I'm using rsyslog with Palo Alto data coming in and it is working with the PA app. So, YES, it will work.

0 Karma
Highlighted

Re: can we use rsyslog instead of syslog-ng for palo alto app in splunk?

New Member

Hello cpetterborg

Could you please help me with the configuration ,so that i can fix my issue

0 Karma
Highlighted

Re: can we use rsyslog instead of syslog-ng for palo alto app in splunk?

New Member

Where you are to get a working config?

0 Karma
Highlighted

Re: can we use rsyslog instead of syslog-ng for palo alto app in splunk?

SplunkTrust
SplunkTrust

Yes, I'd be happy to help. I'm not sure how far you are in your syslog server configuration. I'll need more information, including what you are doing with your UF/HF.

View solution in original post

0 Karma
Highlighted

Re: can we use rsyslog instead of syslog-ng for palo alto app in splunk?

Super Champion

if you can put the syslog-ng config, i can convert to rsyslog

0 Karma