Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About panguy
panguy
Contributor
Member since:
05-03-2016
12-09-2020
Community Statistics
| Posts | 83 |
| Solutions | 14 |
| Karma Given | 7 |
| Karma Received | 20 |
| Member Since | 05-03-2016 |
Activity Feed
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 09-28-2021 06:50 AM
- Posted Re: Exception: <class 'PermissionError'>, Value: [Errno 13] Permission denied on Installation. 11-25-2020 01:21 PM
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 11-11-2020 12:49 PM
- Got Karma for Re: Palo Alto Networks Add-on: How to stop "minemeld" lookup errors?. 10-05-2020 11:46 AM
- Posted Re: Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-05-2020 08:28 AM
- Karma Re: Why is App Inspect failing in inputs.conf.spec? for thambisetty. 08-05-2020 08:28 AM
- Posted Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Tagged Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Tagged Why is App Inspect failing in inputs.conf.spec? on All Apps and Add-ons. 08-04-2020 09:08 PM
- Got Karma for Re: Palo Alto Networks global protect only shows one month of data. 06-05-2020 12:50 AM
- Got Karma for Re: Palo Alto Add-on CIM Network_Traffic, can we map only end events?. 06-05-2020 12:50 AM
- Karma Re: Error at search time after upgrading Palo Alto Networks App for Splunk to version 6.0 for rphillips_splun. 06-05-2020 12:49 AM
- Got Karma for Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0. 06-05-2020 12:49 AM
- Got Karma for Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0. 06-05-2020 12:49 AM
- Got Karma for Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0. 06-05-2020 12:49 AM
- Got Karma for Re: Can not configure accounts in 6.0 add-on after upgrade?. 06-05-2020 12:49 AM
- Got Karma for Re: Threatlist Error after clean install of Palo Alto App and Add-on 6.0. 06-05-2020 12:49 AM
- Got Karma for Re: Palo Alto Networks App for Splunk: pan_firewall datamodel issue after upgrading App to 6.0.1. 06-05-2020 12:49 AM
- Got Karma for Re: Palo Alto Networks Add-on for Splunk: {"customized_settings"{}} shows up when setting up freshly installed TA. 06-05-2020 12:49 AM
- Got Karma for Re: Palo Alto Dashboards: Only parsing last 7 days. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
11-25-2020
01:21 PM
I had this same problem when upgrading Splunk. After untaring the TGZ file to my $SPLUNK_HOME. cd $SPLUNK_ROOT_DIR
ls -lah This confirmed the owner of the folder changed to 10777 I went ahead and ran this line to fix permissions chown -R splunk:splunk $SPLUNK_HOME In your case change the user to root. Hope that helps.
... View more
08-05-2020
08:28 AM
Thank you. The App Inspect error is misleading. It makes it seem like we need to add it into inputs.conf.spec file. I removed it from inputs.conf.spec and added it to only inputs.conf and it now passes.
... View more
08-04-2020
09:08 PM
I am currently getting this failure when running my add-on through appinspect:
check_inputs_conf_spec_stanzas_has_python_version_property
My README/inputs.conf.spec
[autofocus_export://<name>]
python.version = python3
label =
interval =
AppInspect Report:
Modular input "autofocus_export" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 1
Current documentation for inputs.conf.spec doesn't mention using python.version. Any help would be appreciate
... View more
Labels
- Labels:
-
add-on
-
modular input
-
python
06-02-2020
03:24 PM
3 Karma
try commenting out line 125, 126 173, 174 from props.conf in Splunk_TA_paloalto. This answer works as of version 6.2.0 of the add-on.
... View more
06-02-2020
03:17 PM
what lines did you comment out? I'm assuming your commenting props.conf
... View more
06-02-2020
03:04 PM
Sorry, I didn't realize there is no option to disable it from the GUI. Commenting it out should work. Did you restart the instances?
... View more
06-02-2020
01:59 PM
Have you tried disabling the automatic lookups from the "Lookups" setting page?
... View more
06-02-2020
01:42 PM
I may need a little more context. Firewall logs are generally forwarded to the Splunk instance. Splunk shouldn't need to authenticate with a Firewall to get logs.
... View more
06-02-2020
09:42 AM
The Palo Alto Networks add-on was built using Splunk's Add-on builder and leverages Splunk's credentials encryption method from the settings page.
... View more
05-13-2020
03:00 PM
Please open Browser Inspector and click on the network tab. Let me know what files are showing up as 404.
... View more
03-11-2020
04:58 PM
Yes, I can confirm this is a breaking update for GlobalProtect.
GlobalProtect now has its own log type. It is no longer apart of the system log type. We will be updating the app and add-on to reflect this change.
Since GlobalProtect has it's own log type, you need to activate log forwarding for GlobalProtect. This can be done at Device -> Log Settings. You will see a new section for GlobalProtect as well as IP-TAG logs. Add a filter to the section to forward logs.
... View more
02-27-2020
03:10 PM
This is a known issue with Cortex that is planned to be fixed. The empty value was in place of a serial number. In the future there will be a value here to signify this is coming from Cortex. Temporary work around is to change the REGEX to ^[^,]+,[^,]+,[^,]?+,THREAT,
... View more
09-05-2019
12:21 PM
I have gone ahead and added 7.3 as supported on both the app and add-on. Thank you.
... View more
08-08-2019
08:42 AM
Unfortunately, we don't have documentation on rsyslog. Essentially you want to make sure rsyslog does not do any type of parsing before it forwards to Splunk. You will need to check documentation on how to do this with rsyslog.
... View more
08-06-2019
10:31 AM
This might be an issue with your syslog-ng server. I would recommend checking the config on the syslog server. Did you follow this guide: https://splunk.paloaltonetworks.com/universal-forwarder.html?
... View more
08-05-2019
09:29 AM
Are you seeing 2 entries in splunk that are the same or 1 entry in splunk with 2 lines of the same log?
... View more
07-25-2019
07:19 PM
1 Karma
The dashboard’s are built on accelerated data models. By default they are set to 7 days. You can increase the data acceleration from the data model UI. Documentation on this is available here.
https://docs.splunk.com/Documentation/Splunk/7.3.0/Knowledge/Managedatamodels
... View more
06-26-2019
12:44 PM
I'm not sure what you mean by "TA introduces". The TA does not add any fields to your logs. It looks for the default syslog format from the Firewall. If any fields are added it isn't being added by the TA.
... View more
06-25-2019
04:42 PM
The firewall only supports IP address's for dynamics address groups.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-09-2020
06:06 PM
|
Karma from
Karma given to
