What Splunk architecture do you have? As sourcetype=pan_logs works, I suspect you might have simply incorrectly named the sourcetype incorrectly in inputs.conf. It should be 'sourcetype=pan_log' not 'sourcetype=pan_logs'. The app will rewrite sourcetype=pan_log to other sourcetypes based on data being sent in with a sourcetype of 'pan_log'. If sourcetype=pan_logs happens to be a typo and the sourcetype is actually 'pan_log', then I suspect you have a distributed architecture. In a distributed architecture there are some processes (in particular the sourcetype renaming) which are performed by the indexers as data goes in. The main config you need is in the props.conf and transforms.conf files (should be here: $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/default/). The configuration in these files is what rewrites the pan_log sourcetype to each respective sourcetype based on text in each log message. Hope that helps ... View more