Hi, After following steps in WildFire in below url https://splunk.paloaltonetworks.com/wildfire.html Add the Wildfire API key There is no data seen in Splunk Cloud. Please help to check Wildfire side to see if there any error message when Splunk Cloud tried to talk to it. By the way, we also send the Panorama logs via on-premise Splunk heavy forwarder to Splunk Cloud and it's working as designed. Thank you. ... View more

One question about “Microsoft Office 365 App for Splunk”. Can it use log data from “Microsoft Azure Active Directory Add-on for Splunk” for the Azure AD logs? Or does it can only get logs data from “Splunk Add-on for Microsoft Office 365”? If it can only get logs data from “Splunk Add-on for Microsoft Office 365”, should we disabled the logs data from “Microsoft Azure Active Directory Add-on for Splunk”? If both “Splunk Add-on for Microsoft Office 365” & “Microsoft Azure Active Directory Add-on for Splunk” get data from Azure AD, will they get duplicate logs? Thank you. ... View more

Hi, We are trying to get AD domain controller log data to Splunk Cloud by installing universal forwarder and Splunk Add-on for Windows in AD domain controllers in ABC. From the link below, it talks about using GUI interface of Windows. https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/User/ForwardDataToSplunkCloudFromWindows However, as our AD DCs are installed only with Windows 2016 Standard Core, there is no GUI available. After checking below link, https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/InstallaWindowsuniversalforwarderfromthecommandline it doesn't provide how to install the Splunk Add-on for Windows while installing universal forwarder as mentioned in the GUI guide quoted below. "Considerations for enabling data inputs in the installer If you enable data inputs in the Enable Inputs dialog box when installing the universal forwarder, the installer also installs the Splunk Add-on for Windows. It saves the configuration that enables those inputs into the add-on. This configuration includes index definitions." It would be great if you can provide the cli commands to set up both universal forwarder and Splunk Add-on for Windows in AD domain controller to send logs directly to Splunk Cloud. ... View more

Hi, We recently purchased Splunk Cloud and is on the process to get data into Splunk Cloud. We have searched a Splunk and Palo Alto documentation regrading how to get on premise Panorama log data into Splunk Cloud, but there isn't much luck. Most of the documents are for Splunk Enterprise. Please provide guidance how to achieve it such as does it need to go via a on-premise Splunk heavy forwarder? or does it need to be sent to a syslog server on which a universal forwarder is installed, then it forwards data to on premise heavy forwarder, then to Splunk Cloud? Any guidance is much appreciated. ... View more