The Palo Alto Networks Splunk App and Add-on are designed to work together, and with Splunk Enterprise Security if available. The App requires the Add-on to be installed. The Add-on can be used with or without the App.

Where to install

Splunk Node What to install
Search Head Add-on and App
Indexer Add-on only
Heavy Forwarder Add-on only
Universal Forwarder None

Some organizations prefer not to install Add-ons on Search Heads. This is fine for log ingest, but will prevent some advanced features from functioning, such as Adaptive Response and Threat Intelligence.

Important changes

Previous guidance was to install the App and Add-on to all Search Heads, Indexers, and Heavy Forwarders. However, this can result in duplicate storage of accelerated datamodels. Now, it is recommended to install the App only on Search Heads per the table above. If you have installed the App on Indexers or Heavy Forwarders, please delete the App so only the Add-on remains on those nodes.

Earlier versions of the App would install the Add-on automatically. This is no longer allowed by Splunk so since App 5.4.2 you are required to install the App and Add-on individually.

Data Model acceleration is no longer enabled by default. Dashboards will not display any data until the data model is accelerated.

Install the App and Add-on

Install the Palo Alto Networks App by downloading it from the App homepage, or by installing it from within Splunk.

Downloading the App and Add-on from within Splunk Enterprise.
Figure: Downloading the App and Add-on from within Splunk Enterprise.

Enable datamodel acceleration

If using the Palo Alto Networks App, you must enable datamodel acceleration to see data in the dashboards. Acceleration is on by default in App 6.0 and lower, and off by default in App 6.1 and higher (due to new Splunk app certification rules)

Enable it now by navigating to Settings -> Datamodels, then select each Palo Alto Networks datamodel and enable acceleration for a time period of your choice.

The time period represents how much data will show in the dashboards, and has a significant impact on storage usage. If unsure, set the acceleration time period to 7 days.

Datamodel acceleration is not required if using the Add-on only.

Alternative: Install from Github

This App is available on SplunkBase and Github. Optionally, you can clone the GitHub repository to install the App. Please feel free to submit contributions to the App using pull requests on GitHub.

From the directory $SPLUNK_HOME/etc/apps/, type the following command:

git clone SplunkforPaloAltoNetworks

From the directory $SPLUNK_HOME/etc/apps/, type the following command:

git clone Splunk_TA_paloalto

Data Model Acceleration

The app dashboard's requires data model acceleration. You must enable the data model that have been installed with the app.

From the Settings menu click on "Data models".

Click on "Edit Acceleration" for each of the data models for the Palo Alto Networks App and check the box next to "acceleration".

results matching ""

    No results matching ""