Welcome to PANW Splunk App/Add-on discussions!

[btorresgil]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions or for help.
• Share ideas.
• Engage with other community members.

We won't monitor Splunk Answers as we can no longer be notified of questions about the App and Add-on. So we're happy to answer your questions here! If you need help from Splunk or the larger community, please post on Splunk Answers too and share the link in your discussion post here.

To get started, comment below with an introduction of yourself and tell us how you use the Palo Alto Networks App and Add-on for Splunk!

[n0psl1de]

Hello, I'm troubleshooting a few issues with the Palo Alto app (app version 7.0.1, addon version 7.01, splunk 8.2.1). The first issue: when opening the app we receive the following error "A custom JavaScript Error caused an issue loading your dashboard, likely due to the dashboard version update. See the developer console for more details." The second issue is that when attempting to open the Configuration dashboard we receive a 404 error.

[btorresgil]

Unfortunately, this is a known issue at Splunk regarding Splunk Cloud. They seem to have deployed an update to jQuery that wasn't supposed to go out until Aug 31. A new version of our App/Add-on will be ready this week that works around the problem in Splunk Cloud. Sorry for the inconvenience.

[bhagyashriyan]

I want to send aperture logs to both Splunk enterprise and Splunk Cloud. Is it possible to connect to two clients with one client app, as there is provision to create only one. If not, what is the approach?

[rtkdford]

Hello, we are having issues with pan:firewall_cloud parser (which came with the Palo Alto Netowrks Add-on) not parsing logs from Cortex Data Lake. We are centralizing all of our SASE Prisma and Firewall logs into the Cortex Data Lake and then streaming them from there to Splunk Cloud via the HEC. When I configure that HEC to use the Source Type of pan:firewall_cloud, which was recommended in the setup docs, we don't get field extraction. When I use a standard _json parser it extracts all fields as expected. Is anyone else having this issue? Is there a fix? I can't use any of the Palo dashboards and there is no CIM normalization happening without that official Add-on parser working.