Splunk Add on for PA - incorrect tagging of Network sessions

[lakshman239]

** This is not a question, but adding this info for awareness for people using PA and CIM **

The default/tags.conf for start and end eventtypes is incorrect. It should be as follows:
[eventtype=pan_traffic_start]
network = enabled
communicate=enabled
start = enabled
session = disabled

[eventtype=pan_traffic_end]
network = enabled
communicate=enabled
end = enabled
session = disabled

[lakshman239]

I have submitted a issue request - https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/issues/88