Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About raomu
raomu
Explorer
Member since:
11-30-2017
04-25-2025
Community Statistics
| Posts | 76 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 3 |
| Member Since | 11-30-2017 |
Activity Feed
- Posted how to forwarder HEC inputs logs to 2 different splunk instance ( Splunk OnPrem and SplunkCloud ) on Splunk Cloud Platform. 04-25-2025 10:44 PM
- Got Karma for What is the best way to forward Vcenter and ESXi host logs to Splunk?. 06-05-2020 12:49 AM
- Got Karma for Palo Alto Apps not showing any data. 06-05-2020 12:49 AM
- Got Karma for How to search what values are missing in my lookup table?. 06-05-2020 12:49 AM
- Karma Re: splunk SAML onelogin for splunkgk. 06-05-2020 12:48 AM
- Posted Re: How to tell if accelerated data model is still rebuilding? on Reporting. 09-17-2018 10:12 AM
- Posted Re: Verification of SAML assertion using cert failed on Security. 05-01-2018 08:59 PM
- Posted What is the best way to forward Vcenter and ESXi host logs to Splunk? on Getting Data In. 04-02-2018 10:36 PM
- Tagged What is the best way to forward Vcenter and ESXi host logs to Splunk? on Getting Data In. 04-02-2018 10:36 PM
- Tagged What is the best way to forward Vcenter and ESXi host logs to Splunk? on Getting Data In. 04-02-2018 10:36 PM
- Tagged What is the best way to forward Vcenter and ESXi host logs to Splunk? on Getting Data In. 04-02-2018 10:36 PM
- Tagged What is the best way to forward Vcenter and ESXi host logs to Splunk? on Getting Data In. 04-02-2018 10:36 PM
- Tagged What is the best way to forward Vcenter and ESXi host logs to Splunk? on Getting Data In. 04-02-2018 10:36 PM
- Posted Re: Cisco IPS logs in spunk issue on All Apps and Add-ons. 03-05-2018 11:26 PM
- Posted Re: Cisco IPS logs in spunk issue on All Apps and Add-ons. 03-05-2018 11:19 PM
- Posted Re: what can be done to keep the past in the past? on Splunk Search. 03-05-2018 11:13 PM
- Posted Re: what can be done to keep the past in the past? on Splunk Search. 03-05-2018 10:23 PM
- Posted what can be done to keep the past in the past? on Splunk Search. 03-05-2018 07:03 PM
- Posted Cisco IPS logs in spunk issue on All Apps and Add-ons. 03-05-2018 06:54 PM
- Posted How to delete the report for a user whose account doesn't not exists anymore in splunk on Knowledge Management. 02-28-2018 09:37 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-10-2018
08:08 AM
do we need to any configuration on add-on Side on search head ? I see there is a configuration tab.
... View more
01-10-2018
01:26 AM
Thanks for all your help. I had already gone though that link, didn’t help much. I have a case open with Splunk tomorrow let’s see if they have to say anything on this. I will keep you posted the results. Thanks
... View more
01-10-2018
01:14 AM
log.traffic end
log.traffic start
log.traffic.end end
log.traffic.start start
... View more
01-10-2018
01:13 AM
log.file file
log.system general
log.system url-filtering
log.traffic deny
log.traffic drop
... View more
01-10-2018
01:12 AM
log.file file
log.system general
log.system url-filtering
log.traffic deny
log.traffic drop
log.traffic end
log.traffic start
log.traffic.end end
log.traffic.start start
... View more
01-10-2018
01:12 AM
nodename log.log_subtype
log deny
log drop
log end
log file
log general
log start
log url-filtering
... View more
01-10-2018
01:11 AM
nodename log.log_subtype
log deny
log drop
log end
log file
log general
log start
log url-filtering
log.file file
log.system general
log.system url-filtering
log.traffic deny
log.traffic drop
log.traffic end
log.traffic start
log.traffic.end end
log.traffic.start start
... View more
01-10-2018
12:50 AM
I believe its not pulling all the nodename, What I get is :
log
log.file
log.system
log.traffic
log.traffic.end
log.traffic.start
but there are some which I know I am missing. For example nodename="log.correlation" like this there might others also, which I am not sure.
... View more
01-10-2018
12:16 AM
When clicked on user behavior tab it’ shows me values in 2 panels. 1) Rare Appliaction 2) traffic events
... View more
01-09-2018
11:29 PM
We have all default dashboard which comes with Palo Alto App, but none of them populate any data. The version we have 6.x
... View more
01-09-2018
11:12 PM
Let me know if you think we need to rebuild or what next ?
Once again thanks 🙂
... View more
01-09-2018
11:11 PM
MODEL
Datasets
6 Events Edit
Permissions
Shared in App. Owned by nobody. Edit
ACCELERATION
Rebuild Update Edit
Status
100.00% Completed
Access Count
159. Last Access: 1/10/18 1:08:47.000 AM
Size on Disk
39.02MB
Summary Range
604800 second(s)
Buckets
3365
Updated
1/10/18 1:10:10.000 AM
... View more
01-09-2018
11:00 PM
I checked under Data Model Audit and it shows status 100%
Also, It say logs Indexes for 24 hrs
Do you think we need to wait for sometime ?
... View more
01-09-2018
10:57 PM
I check under Data model Audit :
datamodel acceleration retention earliest latest build_inprogress build_complete(%) size(MB) last_error
pan_aperture enabled 7 days 12/31/1969 18:00:00 12/31/2037 22:00:00 0 100.0 37.2
pan_endpoint enabled 7 days 12/31/1969 18:00:00 12/31/2037 22:00:00 0 100.0 37.2
pan_firewall enabled 7 days 12/31/1969 18:00:00 12/31/2037 22:00:00 0 100.0 6258.7
pan_wildfire_report enabled 31 days 12/31/1969 18:00:00 12/31/2037 22:00:00 0 100.0 217.8
... View more
01-09-2018
10:56 PM
I checked Datamodel Acceleration Status :
pan_aperture enabled 7 days 12/31/1969 18:00:00 12/31/2037 22:00:00 0 100.0 37.2
pan_endpoint enabled 7 days 12/31/1969 18:00:00 12/31/2037 22:00:00 0 100.0 37.2
pan_firewall enabled 7 days 12/31/1969 18:00:00 12/31/2037 22:00:00 0 100.0 6258.7
pan_wildfire_report enabled 31 days 12/31/1969 18:00:00 12/31/2037 22:00:00 0 100.0 217.8
... View more
01-09-2018
10:41 PM
Since I got the count, do you still think Acceleration of the data model might be disabled ?
Thanks for your time and suggestion.
... View more
01-09-2018
10:40 PM
I ran this :
| tstats summariesonly=t count FROM datamodel="pan_firewall"
Result below :
Count
10898915
... View more
01-09-2018
10:37 PM
I have schedule report"AAA" which runs once in a month ( pulls huge number of records for last 6 months)
I have another dashboard where I have one panel showing "AAA" data.
my code is :
<query>| loadjob savedsearch="username:search:Domain_Controllers_Status_In_Splunk"</query>
</search>
It use work fine till last month, and now I don't see any data pull in Dashboard panel. Although the schedule reports works fine.
Any idea how long the saved searches are accessible is there ant time frame like a week or some time is set, I am assuming if the saved is not getting expired.
Any suggestion.
... View more
01-09-2018
10:27 PM
1) pan:log
2)pan:traffic
3)pan:system
4)pan:threat
But, I none of my dashboard in Palo Alto gives any result.
Please suggest.
... View more
01-09-2018
10:26 PM
Hello,
When you say :
See [pan_log] in props.conf of TA_Palo. -- I understand this you asking me to check props.conf of Palo Alto Add-on, Which is not correct, we don't have any props.conf on add-on side i.e. TA_Plao
Adding the same settings to your props.conf will be imported correctly --- I didn't understand this part.
Let me know if I understand you correctly : Are you asking me to copy the [pan_log] which Is available in Palo Alto App but in Palo Alto TA ( add-on) to Palo Alto add-on ?
Also, the good part, after we install the Palo Alto app and add-on on indexers side, we are able to populate the 4 soucretype automatically :
1) pan:log
2)pan:traffic
3)pan:system
4)pan:threat
But, I none of my dashboard in Palo Alto gives any result.
Please suggest.
... View more
01-09-2018
10:04 PM
appreciate your response.
So, recently we finished installing Palo Alto App/add-on SH and indexers. One good thing is now that I am able to see 4 source type populating automatically:
Example :
index=AAA sourcetype=pan:*
I can see all 4 sourcetype now i.e
1) pan:log
2)pan:traffic
3)pan:system
4)pan:threat
But, I none of my dashboard in Palo Alto gives any result.
Please suggest.
... View more
01-09-2018
05:56 PM
Thanks for your response.
We have installed Palo Alto add-on and App both on Search Head / Indexers.
So, Next you want me to try copying the Props.conf settings from Palo Alto App and add the same setting to Palo Alto Add-on ? Please confirm.
... View more
12-05-2017
09:25 PM
1 Karma
The way syslog is setup is the firewall is forward to the management platform and this will forward the syslog into splunk. So we are getting the logs from management platform in Splunk in our default indexer which "AAA" and default source type "BBB" .
We have also installed Palo Alto add-on to indexers (in cloud) and also deployed palo Alto app on search head .
we have created a props.conf and transforms.conf which is segrating the Palo Alto data from default soucertype "AAA" to "pan:logs" . So now we have palo alto data coming in to our default indexer "AAA" and soucertype "pan:logs" .
Now, I have seen in some of the articles where it mention that in case of palo alto the index is suppose to be "pan_log" and soucretype is "pan_log" . is this something what I need to do in order to see data to be populated in Palo Alto app in spunk ?
please suggest..
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-25-2025
10:29 PM
|
