thank you for your suggestion. Based on this, I edited the file to have both normal and audit logs but still can't see all the traffic from Checkpoint logs. Please suggest if I am following this correctly. thank you. Below is the 'fw1-loggrabber.conf' file. DEBUG_LEVEL="0" FW1_LOGFILE="fw.log" FW1_OUTPUT="logs" FW1_TYPE="ng" FW1_MODE="normal" FW1_MODE="audit" ONLINE_MODE="no" RESOLVE_MODE="no" RECORD_SEPARATOR="|" DATEFORMAT="cp" LOGGING_CONFIGURATION=screen OUTPUT_FILE_PREFIX="fw1-loggrabber" OUTPUT_FILE_ROTATESIZE=1048576 AUDIT_FILTER_RULE="action=accept|drop" ... View more

Below is fw1-loggrabber.conf on the environment. DEBUG_LEVEL= DEBUG_LEVEL="0" FW1 configuration settings FW1_LOGFILE= FW1_LOGFILE="fw.log" FW1_OUTPUT= FW1_OUTPUT="logs" FW1_TYPE= FW1_TYPE="ng" FW1_MODE= FW1_MODE="normal" Ref: Change CHG48985 - Ingest Checkpoint Audit logs in Splunk FW1_MODE="audit" ONLINE_MODE= ONLINE_MODE="no" RESOLVE_MODE= RESOLVE_MODE="no" RECORD_SEPARATOR= RECORD_SEPARATOR="|" DATEFORMAT= cp = " 3Feb2004 14:15:16" unix = "1051655431" std = "2004-02-03 14:15:16" DATEFORMAT="cp" LOGGING_CONFIGURATION= syslog mode is only Unix like Operating Systems, such as Linux, Solaris LOGGING_CONFIGURATION=screen OUTPUT_FILE_PREFIX= OUTPUT_FILE_PREFIX="fw1-loggrabber" OUTPUT_FILE_ROTATESIZE= OUTPUT_FILE_ROTATESIZE=1048576 ODBC_DSN= ODBC_DSN=FW1-LOGGRABBER FW1_FILTER_RULE= FW1_FILTER_RULE="action=drop" AUDIT_FILTER_RULE= AUDIT_FILTER_RULE="action=accept" FIELDS= FIELDS=loc;src;dst ... View more