** This is not a question, but adding this info for awareness for people using PA and CIM **
The default/tags.conf for start and end eventtypes is incorrect. It should be as follows:
[eventtype=pan_traffic_start]
network = enabled
communicate=enabled
start = enabled
session = disabled
[eventtype=pan_traffic_end]
network = enabled
communicate=enabled
end = enabled
session = disabled
I have submitted a issue request - https://github.com/PaloAltoNetworks/SplunkforPaloAltoNetworks/issues/88