Hi Ricfez,   sorry i forgot to add more detail to this but no the ip hasn't changed or the hostname of the firewalls, running a tcpdump i can see the logs are hitting my Sc4s(on-prem) to our splunk could instance  , however on the fw themselves the format of the logs were set as "splunk" maybe this could have an effect?  ... View more