What is the 'custom' log format to be used when forwarding configuration logs to 'Palo Alto Networks App' in Splunk?
4162
Created On 02/23/24 19:43 PM - Last Modified 08/05/24 21:35 PM
Question
What is the 'custom' log format to be used when forwarding configuration logs to 'Palo Alto Networks App' in Splunk?
Environment
- Palo Alto Panorama or Firewall
- Supported PAN-OS
- Splunk Server using Palo Alto Networks App
Answer
Configure the custom log format for configuration as follows:
- Go to GUI: Device > Server Profiles > Syslog > Syslog Server Profile >
- Edit the configured syslog server profile.
- Click on "Custom Log Format".
- Under "log type", Click on "Config".
- Use the following custom Log Format.
- Click "OK" and commit the configuration.
$domain,$receive_time,$serial,$type,$subtype,$config_ver,$time_generated,$host,$vsys,$cmd,$admin,$client,$result,$path,$seqno,$actionflags,$before-change-detail,$after-change-detail,$dg_hier_level_1,$dg_hier_level_2,$dg_hier_level_3,$dg_hier_level_4,$vsys_name,$device_name,$dg_id,$comment,$tpl_id,$high_res_timestamp
Additional Information
'Palo Alto Networks' App for Splunk: https://splunkbase.splunk.com/app/491