Splunk receives the logs from PAN firewall and logs show up with index=pan_logs , but when I try index=pan_logs sourcetype=pan_config , no logs show up. Then I tried sourcetype=pan_logs instead of sourcetype=pan_config . Logs start showing up after that change, but according to the following message, the logs are not getting parsed correctly. Check that you are not using a Custom Log Format in the syslog server setting on the firewall. " NO custom log in use" Check that the inputs.conf file is configured with the line "no_appending_timestamp = true", " yes, the line is in the inputs.conf" No forwarder is in use. Not sure how to resolve the parsing issue. PAN Firewall version is 6.2.0. Splunk for Palo Alto firewall is version 4.2.1 ... View more