Palo alto splunk syslog view

[Venkatesan_radhakrishnan]

Hi Community,

While exporting syslog from palo alto splunk in default format, what is the default format for config logs.

Where I can see the default format. Next to hostname what is that value "1" where it comes from?

[kiwi]

Hi @Venkatesan_radhakrishnan ,

Guessing that will be vsys:

CEF-style format that was used for Config log type :

CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$result|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial shost=$host cs3Label=Virtual System cs3=$vsys act=$cmd duser=$admin destinationServiceName=$client msg=$path externalId=$seqno PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSActionFlags=$actionflags cs1Label=Before Change Detail cs1=$before-change-detail cs2Label=After Change Detail cs2=$after-change-detail

Check out all other CEF-style formats :

Common Event Format (CEF) Configuration Guides 

Hope this helps,

-Kiwi.

[Venkatesan_radhakrishnan]

Hi @kiwi 

I don't think so it is vsys, because it is mentioned in the last stage of format. 

Regards

venky

[Venkatesan_radhakrishnan]

Hi Community,

Did you guess know what that value "1"

Jun 25 11:44:54 172.16.3.30 Jun 25 22:52:00 PA-VM 1,2020/06/25 22:52:00,015351000048743,CONFIG,0,0,2020/06/25 22:52:00,192.168.167.94,,commit,venky,Web,Submitted,,9377,0x0,0,0,0,0,,PA-VM