Panorama Splunk Logs Forwarding

B.Dagdelen — Fri, 09 May 2025 09:48:30 GMT

Hello all, when I try to forward logs from Panorama to Splunk I couldn't see the logs for the past 15 days. I wanna export these logs manually and add them to Splunk but even though I set the row limit on Panorama CSV to 1 million I still only see the logs for the past 4 hours. And when I try to export these logs on the CLI via SCP/FTP, I can't get past the 1 million row limitation. Is there any other way to export logs? Below are the methods I've already tried.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clj3

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-cli-quick-start/use-the-cli/use-secure-copy-to-import-and-export-files/export-and-import-a-complete-log-database-logdb

Re: Panorama Splunk Logs Forwarding

ozheng — Thu, 15 May 2025 04:10:14 GMT

Hello @B.Dagdelen ,

If you want to export past logs:

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-xml-api-request-types/retrieve-logs-api/example-use-the-api-to-retrieve-traffic-logs

For real time/new logs, I think you should configure the log forwarding from your firewalls or the Panorama to your splunk directly.

Olivier

topic Re: Panorama Splunk Logs Forwarding in Panorama Discussions

Panorama Splunk Logs Forwarding

Re: Panorama Splunk Logs Forwarding