Hello,     Current setup is Palo Alto firewall and using Sc4s (splunk connect for syslog) , so far getting all logs for Palo Alto except for wildfire. Can someone tell me do we need the apps or add-ons to be able to create good detections for the firewall ? if so Can someone tell me what apps and add-ons should be used and do they have to be configured?  Getting my information for here: https://pan.dev/splunk/docs/    Regards,   ... View more

Hello looking for way to create an alert based off the difference between times and only execute if the time is greater than or equal to x mins.    Code:  index=net* sourcetype=pan:* action="blocked" OR action="failure" |stats count min(_time) as firstTime max(_time) as lastTime by src_ip,dest,dest_port,rule,tag,log_subtype,transport |where count >= 10 |eval diff=lastTime-firstTime ```|eval diff=strftime(diff, "%d %H:%M:%S") ``` |eval diff=strftime(diff, "%M:%S") | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`  Regards,    ... View more

Query:  | tstats count from datamodel=Network_Sessions.All_Sessions where nodename=All_Sessions.VPN action=failure vpn.signature="WebVPN" by _time span=1h I'm not understanding something with this datamodel  but my output is always 0 but when I look at in pivot table I can see data from it.  ... View more