For details on cookie usage on our site, read our Privacy Policy
Syslog Custom Format for Splunk
- LIVEcommunity
- Discussions
- General Topics
- Syslog Custom Format for Splunk
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
Syslog Custom Format for Splunk
- Mark as New
- Subscribe to RSS Feed
- Permalink
04-24-2020 01:30 PM
I'm trying to get the firewall to send before and after change detail to splunk. I've tried various formats in Custom Log Format, but any changes I make result in no logs being sent to splunk. What is the correct format for Custom Log Format when using syslog and splunk? I'm running PA OS 8.1
- Mark as New
- Subscribe to RSS Feed
- Permalink
04-26-2020 01:24 AM
Making a custom format shouldn't break sending the syslog to Splunk, are you sure that the logs aren't actually getting to Splunk at all? If you could share our format and the actual software version you are running we might be able to identify something.
- Mark as New
- Subscribe to RSS Feed
- Permalink
04-27-2020 06:56 AM
Logs are being shipped to Splunk. I'm following the directions to use custom formatting 'Enter the log format above. Click on the field names in the left panel to include them in the log format.' by clicking on the name, then commit, and then no more config logs after that change to use custom log formatting. Return to default and config logs start working again. Just confirmed again. Maybe something for tech support?
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-24-2020 07:23 AM
Hi Mike,
Did you get any resolution for this issue
Regards
Venky
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-25-2020 07:08 AM
No, I did not get a resolution for this.
- Cortex XDR PoC: Monitoring Malicious Chrome Extensions in Cortex XDR Discussions
- LEEF Format in General Topics
- Cortex XDR PoC Lab ft. CVE-2021-3560 in Cortex XDR Discussions
- DTRH: CIS Benchmarking - 3rd Party Data Ingestion | Data Parsing | Widgets & Dashboards in Cortex XDR Discussions
- Logvolume difference between Palo Format to Splunk and CEF Format to Azure Sentinel in General Topics
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
