I installed the Palo ALto app on the splunk enterprise server and was able to pull data into the app. But i was reading that it wasn't a recommended setup. so i pushed the app out to the universal forwarder. I haven't been able to get PA data to the indexer since. Can someone
↧