Hi, Can i run a search which specify that these type of logs are blocked in palo alto firewall by specific policy. if i can do that then please let me know. ... View more

I am configuring palo alto firewall and splunk to get data into splunk cloud from firewall. I configured firewall with syslog server and syslog server is getting the data from firewall working properly. I am using splunk enterprise as heavy forwarder . just want to ask you gyzz, is it correct approah and how can i configure splunk enterprise as heavy forwarder. or do i need to configure syslog more like creating files (.conf) so it an direct logs. we are using same syslog server for other logs like cisco and that is already configure and going data to splunk cloud. ... View more