Hi everyone, We have the following setup: Check Point Firewall is configured to send logs via syslog over UDP (port 514). Logs are received by a Linux server running rsyslog. rsyslog writes these logs to a local file (e.g., /var/log/CheckPoint.log). Splunk (on the same server) reads this file and indexes the logs Although the Check Point firewall sends complete logs (visible in tcpdump, including structured data and original timestamps), only a truncated version of the log is written to the file by rsyslog. Specifically: The structured message body is missing. Only the syslog header (timestamp, hostname, program name) appears in the file. Can anyonehelp !!  Ty  ... View more