What is your version of CyberArk PAS?
Are you trying to send syslog data from the Vault or via Splunk Universal Forwarder on the component servers?
If syslog, what is your configuration in the dbparm.ini? And Is the SplunkCIM.xsl file in the \PrivateArk\server\syslog directory with the other translator files?
If UF on component, what log files are you monitoring?
Here is a sample configuration that works:
[SYSLOG]
UseLegacySyslogFormat=Yes
SysLogServerIP=ipaddress of splunk indexer
SysLogServerProtocol=UDP
SysLogServerPort=514
SysLogTranslatorFile=Syslog\SplunkCIM.xsl
... View more