Documentation for PaloAlto Cortex source

[rucete]

Hi!
The documentation for PaloAlto Networks Cortex looks incomplete. It has a typo in the title (corteXt instead of cortex) and the key for index configuration does not seem to follow the vendor_product_key convention. Which is the correct key? Is the documentation in this section complete?

Thnx

[rjha-splunk]

Hi @rucete ,

We will check and correct it in next iteration of Documentation update, please find the approach in more descriptive way:

1. Best method to manipulate metadata like index,source and sourcename is using app-parsers.
2. The key which you can use in splunk_metadata.csv is {sc4s_vendor}_{sc4s_product}_{sc4s_class} all the sc4s_* values can be checked in splunk ui in fields value.

Note: if sc4s_class doesnt exist then key will be {sc4s_vendor}_{sc4s_product}

[rucete]

Perfect, thnx!