Is there a reason why the auth-success is excluded from the system_actions.csv lookup file in the Splunk Add-on for palo alto networks TA version 1.0.0 that was just released.
This is breaking auth events as only failures are being parsed.
It might be that they forgot it or didn't consider it important for the primary use case. This add-on is Splunk supported, so if you have a support contract then you could reach out to Splunk support.
