I have installed the Onelogin TA and there is a sourcetype parser from that TA that has taken over everything and it is jacking the logs up (onelogin:user). Anybody know why this is happening, and how I can prevent this?
Run a btool to confirm, but it looks like you have a '[default]' stanza inadvertently assigning the incorrect sourcetype. I'd check for the following in /opt/splunk/etc/apps/splunk_ta_onelogin/local/inputs.conf:
