I am ingesting data into Splunk Cloud using Cribl (not directly via GCP Add On) and using Google Cloud TA on the search head for Data enrichment . Since the data is not ingested via Add on , I need to manually create the sourcetypes that match the Add on . I could able to identify all the sourcetypes used by google cloud Add on, except for GCP Firewall logs. Do you guys know what splunk sourcetype is used for GCP Firewall logs, so that GCP TA is satisfied by it ?
