Palo Alto new log category help

[LynneEss]

I have no idea what I need to do here (if anything), and the guy who has dealt with getting data in previously is on holiday for a while so any advice is much appreciated

We upgraded our Palo Alto firewall to a newer version which has moved the VPN logs from the system category to a separate one for GlobalProtect (more info here )

When I noticed we weren’t receiving the VPN logs anymore, we got the firewall guys to forward the new log category to us and our Splunk guy assured me that we wouldn’t need to do anything else

However, the logs are supposedly being forwarded to us now but Splunk isn’t showing them, at least not in the index we have for the Palo Alto logs. Is our Splunk guy wrong and we do actually have to manually set up the new sourcetype? Or have the firewall guys messed up (harder to check due to language barriers and time differences)

I am pretty clueless about this so apologies if this is a silly question

[PickleRick]

It's not clear how you're receiving the logs and what's your configuration. Unless you're actively filtering the event categories the data should land somewhere if it is within the same syslog stream as the events you can see.

Did you confirm (tcpdump? some debug on your syslog layer if you use some intermediate solution) that the events are really getting sent?