Splunk Dev

splunk cloud

raje1
Engager

I am configuring palo alto firewall and splunk to get data into splunk cloud from firewall. I configured firewall with syslog server and syslog server is getting the data from firewall working properly. I am using splunk enterprise as heavy forwarder . just want to ask you gyzz, is it correct approah and how can i configure splunk enterprise as heavy forwarder. or do i need to configure syslog more like creating files (.conf) so it an direct logs. we are using same syslog server for other logs like cisco and that is already configure and going data to splunk cloud.

0 Karma

anmolpatel
Builder

You don't necessarily need the Heavy Forwarder. Would install the UF on the syslog server, and download the UF app from Splunk cloud. This will send all your syslog data to Splunk cloud in an encrypted format.

Since you've data being sent by the same syslog server to Splunk cloud, one of the above is already done.
What you need to do is to create a new app within /opt/splunk/etc/apps which will monitor the palo alto logs.
Look at the monitor stanza
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#inputs.conf.example

Would also check if any of the Palo Alto apps needs to be installed on Splunk cloud to parse the data correctly:
https://splunkbase.splunk.com/apps/#/search/Palo%20Alto/

0 Karma

raje1
Engager

thank you, that was helpful for me. One more question is that i have one more Palo alto firewall for same organization so should i do it with APIs or follow the similar process. Please let me know.

Thnaks!

0 Karma

rajveer005
Engager

But my manager wants me to configure by using API s . Can you please help me. It is totally different palo alto firewall for another department

0 Karma

anmolpatel
Builder
0 Karma

rajveer005
Engager

Yes, its quite helpful but i wonder is it applicable for splunk cloud as it is mentioned on premises of splunk enterprise

0 Karma

anmolpatel
Builder

If you must go with the API, then you will need to install it on a HF.
so: FW <--- (install TA which uses API) HF ---> Splunk Cloud

The syslog option is the best solution:
FW ---> Syslog (install UF with Splunk cloud config) --> Splunk Cloud

0 Karma

rajveer005
Engager

Can you please explain the APIs in detail like the overview and working environment. How it will work and do i need the API all from palo alto and splunk cloud.

0 Karma

anmolpatel
Builder

No issues with how it is currently being done. So stick to the standardised approach where the syslogs are collected to the syslog server and update the document.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...