Palo alto splunk syslog view

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Palo alto splunk syslog view


Hi Community,


While exporting syslog from palo alto splunk in default format, what is the default format for config logs.


Where I can see the default format. Next to hostname what is that value "1" where it comes from?




Community Team Member

Hi @Venkatesan_radhakrishnan ,


Guessing that will be vsys:


CEF-style format that was used for Config log type :


CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$result|$type|1|rt=$cef-formatted-receive_time deviceExternalId=$serial shost=$host cs3Label=Virtual System cs3=$vsys act=$cmd duser=$admin destinationServiceName=$client msg=$path externalId=$seqno PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSActionFlags=$actionflags cs1Label=Before Change Detail cs1=$before-change-detail cs2Label=After Change Detail cs2=$after-change-detail


Check out all other CEF-style formats :

Common Event Format (CEF) Configuration Guides 


Hope this helps,


LIVEcommunity team member, CISSP
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Hi @kiwi 


I don't think so it is vsys, because it is mentioned in the last stage of format. 




Hi Community,


Did you guess know what that value "1"


Jun 25 11:44:54 Jun 25 22:52:00 PA-VM 1,2020/06/25 22:52:00,015351000048743,CONFIG,0,0,2020/06/25 22:52:00,,,commit,venky,Web,Submitted,,9377,0x0,0,0,0,0,,PA-VM
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!