I have found this search for GlobalProtect on PaloAlto Networks App, The information showed its really usefull, the only problem I have it's. How do I show receive_time or time of the log on the Results.
| tstats summariesonly=t latest(log.event_id) AS latest_event, values(log.agent_message) AS log.agent_message, values(log.src_ip) AS log.src_ip count FROM datamodel="pan_firewall" WHERE nodename="log.system.globalprotect" """" groupby _time log.event_id log.user
when i erase the * time* field, this colum disappear, and if I try something like values(log.receivetime) it doesn't show any information.
I just want to show the time without a groupby cause this groups all the logs to 30 mins time all logs example; 10:00 am - 10:30 am.
... View more
I'm having several issues after installing Splunk Forwarder on Any Win10 Device. (Win 10, Win Server 2012,2016).
I'm using the following line:
msiexec.exe /i splunkforwarder-7.3.4.msi FORWARD_SERVER="ADDserver:9991" WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 SPLUNKPASSWORD=*Password* /L*v logfile.txt LAUNCHSPLUNK=1 SERVICESTARTTYPE=auto AGREETOLICENSE=yes /quiet
The App gets installed and but no Logs packages are sent to the Server, The netstat command doesn't show me any: 9991 port connection.
I've done the confirmation using "sc query SplunkForwarder" and the service is running, but again no log gets to be sent to my Splunk Console (Server).
Help please, I'll provide any information you want to know. Or that I'm missing
... View more