Installation

Download

If upgrading to App 5.0, or 6.0, please read the Upgrade Guide.

Not sure what version to download? Check the Compatibility Guide.

The Palo Alto Networks Splunk App and Add-on are designed to work together, and with Splunk Enterprise Security if available. The App requires the Add-on to be installed. The Add-on can be used with or without the App.

Where to install

Splunk Node What to install
Search Head Add-on and App
Indexer Add-on only
Heavy Forwarder Add-on only
Universal Forwarder None

Some organizations prefer not to install Add-ons on Search Heads. This is fine for log ingest, but will prevent some advanced features from functioning, such as Adaptive Response and Threat Intelligence.

Important changes

Previous guidance was to install the App and Add-on to all Search Heads, Indexers, and Heavy Forwarders. However, this can result in duplicate storage of accelerated datamodels. Now, it is recommended to install the App only on Search Heads per the table above. If you have installed the App on Indexers or Heavy Forwarders, please delete the App so only the Add-on remains on those nodes.

Earlier versions of the App would install the Add-on automatically. This is no longer allowed by Splunk so since App 5.4.2 you are required to install the App and Add-on individually.

Install the App and Add-on

Install the Palo Alto Networks App by downloading it from the App homepage, or by installing it from within Splunk.

Downloading the App and Add-on from within Splunk Enterprise.
Figure: Downloading the App and Add-on from within Splunk Enterprise.

Alternative: Install from Github

This App is available on SplunkBase and Github. Optionally, you can clone the GitHub repository to install the App. Please feel free to submit contributions to the App using pull requests on GitHub.

App:
From the directory $SPLUNK_HOME/etc/apps/, type the following command:

git clone https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks.git SplunkforPaloAltoNetworks

Add-on:
From the directory $SPLUNK_HOME/etc/apps/, type the following command:

git clone https://github.com/PaloAltoNetworks/Splunk_TA_paloalto.git Splunk_TA_paloalto

results matching ""

    No results matching ""