topic Syslog Custom Format for Splunk in General Topics

Syslog Custom Format for Splunk

MikeSangray2019 — Fri, 24 Apr 2020 20:30:13 GMT

I'm trying to get the firewall to send before and after change detail to splunk. I've tried various formats in Custom Log Format, but any changes I make result in no logs being sent to splunk. What is the correct format for Custom Log Format when using syslog and splunk? I'm running PA OS 8.1

Re: Syslog Custom Format for Splunk

BPry — Sun, 26 Apr 2020 08:24:24 GMT

@MikeSangray2019,

Making a custom format shouldn't break sending the syslog to Splunk, are you sure that the logs aren't actually getting to Splunk at all? If you could share our format and the actual software version you are running we might be able to identify something.

Re: Syslog Custom Format for Splunk

MikeSangray2019 — Mon, 27 Apr 2020 13:56:51 GMT

Logs are being shipped to Splunk. I'm following the directions to use custom formatting 'Enter the log format above. Click on the field names in the left panel to include them in the log format.' by clicking on the name, then commit, and then no more config logs after that change to use custom log formatting. Return to default and config logs start working again. Just confirmed again. Maybe something for tech support?

Re: Syslog Custom Format for Splunk

Venkatesan_radhakrishnan — Wed, 24 Jun 2020 14:23:13 GMT

Hi Mike,

Did you get any resolution for this issue

Regards

Venky

Re: Syslog Custom Format for Splunk

MikeSangray2019 — Thu, 25 Jun 2020 14:08:13 GMT

No, I did not get a resolution for this.

Re: Syslog Custom Format for Splunk

Venkatesan_radhakrishnan — Thu, 25 Jun 2020 18:23:49 GMT

i'm facing same issue, If you dont mind did you raise it with support.

Regards

Venky

Re: Syslog Custom Format for Splunk

MikeSangray2019 — Thu, 25 Jun 2020 21:18:20 GMT

Sorry, I did not open a ticket with support for this.

Re: Syslog Custom Format for Splunk

MikeSangray2019 — Tue, 02 Feb 2021 17:29:40 GMT

Closer, but still seeing an issue.

Firewall config events are being parsed as pan:config, but without before and after change details. Other details are included, but before and after change details are both 0.

When I set a custom log format and test changing an object name on the firewall, the logs are parsed as pan:log (not pan:config) and I can see the change detail in the raw event message, but now I've lost the other fields since it was parsed as pan:log.

Re: Syslog Custom Format for Splunk

Douglas775 — Wed, 03 Feb 2021 06:58:33 GMT

Frist Click the field names in the left board to remember them for the log design.' by tapping on the name, at that point submit, and afterward no more config logs after that change to utilize custom log organizing.

Re: Syslog Custom Format for Splunk

MikeSangray2019 — Thu, 04 Feb 2021 19:40:20 GMT

That's not working. As I noted in my update I have tried setting a custom log. Doing this changes the way the logs are parsed either with pan:config or pan:log. "When I set a custom log format and test changing an object name on the firewall, the logs are parsed as pan:log (not pan:config) and I can see the change detail in the raw event message, but now I've lost the other fields since it was parsed as pan:log."

Does anyone have this working? I want to believe this is just something with my config that I can fix, but I haven't seen many posts that this works for others.

Re: Syslog Custom Format for Splunk

MikeSangray2019 — Mon, 15 Aug 2022 19:52:40 GMT

Working on this again, still no change in behavior.

Does anyone know if this has been addressed in any 9.1 or 10.x releases?

The log format changes based on if Default logging or Custom Format is used, so the sourcetype isn't set correctly (Splunk).

DEFAULT (sourcetype is set to pan:config, this is correct and working, but no before/after change detail)

<14>Aug 15 14:06:53 PA-1 1,2022/08/15 14:06:53,016201015409,CONFIG,0,0,2022/08/15 14:06:53,192.168.1.10,,edit,adminacct,Web,Succeeded, vsys vsys1 address configlog_testobj,24838,0x0,0,0,0,0,,PA-AMA-Pri,0,

CUSTOM FORMAT (sourcetype is set to pan:log, the before/after change detail is present, but the sourcetype is wrong)
<14>Aug 15 14:18:57 PA-1 0x0 adminacct "configlog_testobj { description ""test change 90""; } " "configlog_testobj { description ""test change 80""; } " Aug 15 2022 19:18:57 GMT Aug 15 2022 19:18:57 GMT Web edit PA-AMA-Pri 192.168.1.10 vsys vsys1 address configlog_testobj 2022/08/15 14:18:57 Succeeded 9.1.12-h3 24843 016201015409 0 2022/08/15 14:18:57 CONFIG

Re: Syslog Custom Format for Splunk

PerryPapanier — Wed, 21 Aug 2024 21:27:31 GMT

Cant you just add the other fields you need in the Custom log Format?

actionflags="$actionflags", admin="$admin", after-change-detail="$after-change-detail", before-change-detail="$before-change-detail", cef-formatted-receive_time="$cef-formatted-receive_time", cef-formatted-time_generated="$cef-formatted-time_generated", client="$client", cmd="$cmd", host="$host", path="$path", receive_time="$receive_time", result="$result", seqno="$seqno", serial="$serial", subtype="$subtype", time_generated="$time_generated", type="$type", vsys="$vsys"

Re: Syslog Custom Format for Splunk

bgooch — Fri, 11 Apr 2025 18:04:41 GMT

Just wanted to reply that I used this formatting for a customer and it worked as advertised to bring in the after-change-detail="$after-change-detail", before-change-detail="$before-change-detail" fields. Thank you for posting this!