Syslog Custom Format for Splunk
cancel
Showing results for 
Search instead for 
Did you mean: 

Syslog Custom Format for Splunk

L3 Networker

I'm trying to get the firewall to send before and after change detail to splunk. I've tried various formats in Custom Log Format, but any changes I make result in no logs being sent to splunk. What is the correct format for Custom Log Format when using syslog and splunk? I'm running PA OS 8.1

 

9 REPLIES 9

Cyber Elite
Cyber Elite

@MikeSangray2019,

Making a custom format shouldn't break sending the syslog to Splunk, are you sure that the logs aren't actually getting to Splunk at all? If you could share our format and the actual software version you are running we might be able to identify something. 

Logs are being shipped to Splunk. I'm following the directions to use custom formatting  'Enter the log format above. Click on the field names in the left panel to include them in the log format.' by clicking on the name, then commit, and then no more config logs after that change to use custom log formatting. Return to default and config logs start working again. Just confirmed again. Maybe something for tech support?

Hi Mike,

 

Did you get any resolution for this issue


Regards

Venky

 

No, I did not get a resolution for this.

Hi 

 

i'm facing same issue, If you dont mind did you raise it with support.

 

Regards

Venky

Sorry, I did not open a ticket with support for this.

Closer, but still seeing an issue.

 

Firewall config events are being parsed as pan:config, but without before and after change details. Other details are included, but before and after change details are both 0.

 

When I set a custom log format and test changing an object name on the firewall, the logs are parsed as pan:log (not pan:config) and I can see the change detail in the raw event message, but now I've lost the other fields since it was parsed as pan:log.

L0 Member

Frist Click the field names in the left board to remember them for the log design.' by tapping on the name, at that point submit, and afterward no more config logs after that change to utilize custom log organizing.

That's not working. As I noted in my update I have tried setting a custom log. Doing this changes the way the logs are parsed either with pan:config or pan:log. "When I set a custom log format and test changing an object name on the firewall, the logs are parsed as pan:log (not pan:config) and I can see the change detail in the raw event message, but now I've lost the other fields since it was parsed as pan:log."

 

Does anyone have this working? I want to believe this is just something with my config that I can fix, but I haven't seen many posts that this works for others.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!