First, click 'Search' in the menu bar, set the time range to "All time", and use one of the available macros, like...
Just for clarity, those are back-ticks surrounding the macro, not apostrophes. You should get at least one event to come up with this search.
If you see events here, verify they are in a format where each field is separated by a comma. If the fields are separated by spaces or any other character, you probably have a custom format set in your firewall syslog settings. Remove it to restore the default syslog format.
If you did not see events in the search, try these troubleshooting steps...
Try removing the line no_appending_timestamp = true from inputs.conf.
Use Wireshark or tcpdump on UDP 514 of the Splunk server to verify you're receiving the syslogs.
On the firewall, check what log types you are sending to Splunk in your Log Forwarding Profile. Try sending all types of traffic and threat logs.
On the firewall, ensure your security policy is logging when a connection ends, and using your Log Forwarding Profile. (you can also log connection starts)
Let me know if any of these helps solve the issue. Thanks!