I have been using the Splunk for Palo Alto Networks app for quite some time now. I am running the most current version 4.1.1 on Splunk Enterprise 6.1.3. The other day, I discovered a conflict with another Splunk app. Both the PANW and other Splunk app parses a field from their index called “product”. The PANW app does it through a props-lookup object called "default : LOOKUP-vendor_info_for_pan_config” which is set to a Global share permissions. By making that Global it doesn’t allow the other Splunk app to do it’s parsing of that same field. Is there a reason that this object is set to Global? When I changed the permission of that object to just the PANW app, it allowed the other Splunk app to do it parsing correctly. Does that object need to be set to Global?
↧