topic Re: Palo alto splunk syslog view in General Topics

Palo alto splunk syslog view

Venkatesan_radhakrishnan — Thu, 25 Jun 2020 06:45:29 GMT

Hi Community,

While exporting syslog from palo alto splunk in default format, what is the default format for config logs.

Where I can see the default format. Next to hostname what is that value "1" where it comes from?

Re: Palo alto splunk syslog view

kiwi — Thu, 25 Jun 2020 08:34:54 GMT

Hi @Venkatesan_radhakrishnan ,

Guessing that will be vsys:

CEF-style format that was used for Config log type :

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$result|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial shost=$host cs3Label=Virtual System cs3=$vsys act=$cmd duser=$admin destinationServiceName=$client msg=$path externalId=$seqno PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSActionFlags=$actionflags cs1Label=Before Change Detail cs1=$before-change-detail cs2Label=After Change Detail cs2=$after-change-detail

Check out all other CEF-style formats :

Common Event Format (CEF) Configuration Guides

Hope this helps,

-Kiwi.

Re: Palo alto splunk syslog view

Venkatesan_radhakrishnan — Thu, 25 Jun 2020 08:38:13 GMT

Hi @kiwi

I don't think so it is vsys, because it is mentioned in the last stage of format.

Regards

venky

Re: Palo alto splunk syslog view

Venkatesan_radhakrishnan — Thu, 25 Jun 2020 18:57:58 GMT

Hi Community,

Did you guess know what that value "1"

Jun 25 11:44:54 172.16.3.30 Jun 25 22:52:00 PA-VM 1,2020/06/25 22:52:00,015351000048743,CONFIG,0,0,2020/06/25 22:52:00,192.168.167.94,,commit,venky,Web,Submitted,,9377,0x0,0,0,0,0,,PA-VM