05-09-2025 02:48 AM
Hello all, when I try to forward logs from Panorama to Splunk I couldn't see the logs for the past 15 days. I wanna export these logs manually and add them to Splunk but even though I set the row limit on Panorama CSV to 1 million I still only see the logs for the past 4 hours. And when I try to export these logs on the CLI via SCP/FTP, I can't get past the 1 million row limitation. Is there any other way to export logs? Below are the methods I've already tried.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clj3
05-14-2025 09:10 PM
Hello @B.Dagdelen ,
If you want to export past logs:
For real time/new logs, I think you should configure the log forwarding from your firewalls or the Panorama to your splunk directly.
Olivier
PCSNE - CISSP
Best Effort contributor
Check out our PANCast Channel
Disclaimer : All messages are my personal ones and do not represent my company's view in any way.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
