targetConfiguration.xml
<?xml version="1.0" encoding="utf-8"?>
<export id="targetObjectUID"><!--object uuid!-->
    <version>5</version> <!-- Version of this file-->
  <is_enabled>true</is_enabled><!--Is the process allowed to run, and start on cpstart-->
  <!-- Destination section defines the properties of the export target -->
  <destination type="syslog"> <!-- Target output type -->
    <ip>re.da.ct.ed</ip><!--the ip of the syslog server-->
    <port>2812</port><!--the port on which the syslog is listening to-->
    <protocol>tcp</protocol><!--udp/tcp-->
        <!--the configuration of tls-->
    <transport>
      <security></security><!--clear/tls-->
          <!-- the following section is relevant only if <security> is tls -->
      <pem_ca_file></pem_ca_file>
          <p12_certificate_file></p12_certificate_file>
          <client_certificate_challenge_phrase></client_certificate_challenge_phrase>
    </transport>
  </destination>
  <!-- Filter Configuration -->
  <dynamicFilter>conf/FilterConfiguration.xml</dynamicFilter>
  <!-- Source section defines the properties of the input stream that will be exported -->
  <source>
    <log_files>1</log_files><!-- on-line[default] | read logs from [number] days back (recommended) | specific file name -->
    <log_types></log_types><!--all[default]|log|audit/-->
    <folder></folder><!--$FWDIR/log[default]|specific path-->
        <read_mode>raw</read_mode><!--raw[default]|semi-unified/-->
  </source>
 <export_log_link>false</export_log_link> <!-- True | False /-->
 <export_attachment_link>false</export_attachment_link> <!-- True | False /-->
 <export_link_ip></export_link_ip> <!-- empty [defaut] | external IP /-->
  <!-- Format section determines the form (headers and mappings) of the exported logs -->
  <format type="splunk">  <!--syslog | cef | leef | generic | splunk | this parameter may differ from the type of destination, for example, destination type = files/format type = CEF -->
    <resolver>
      <mappingConfiguration>MySplunkFieldsMapping.xml</mappingConfiguration><!--if empty the fields are sent as is without renaming-->
      <exportAllFields>true</exportAllFields> <!--in case exportAllFields=true - exported element in fieldsMapping.xml is ignored and fields not from fieldsMapping.xml are exported as notMappedField field-->
    </resolver>
    <!-- Format header configuration (actual to CEF see ./conf directory) -->
    <formatHeaderFile>MySplunkFormatDefinition.xml</formatHeaderFile>
  </format>
  <!-- The following section is for future use of log filtering, please do not modify these values -->
  <filter filter_out_by_connection="false">
                <field  name="product">
                        <value>VPN-1 &amp; FireWall-1</value>
                        <value>HTTPS Inspection</value>
                        <value>VPN-1</value>
                        <value>Security Gateway/Management</value>
                        <value>Firewall</value>
                        <value>FG</value>
                </field>
                <field  name="fw_subproduct">
                        <value>VPN-1 &amp; FireWall-1</value>
                        <value>HTTPS Inspection</value>
                        <value>VPN-1</value>
                        <value>Security Gateway/Management</value>
                        <value>Firewall</value>
                        <value>FG</value>
                </field>
  </filter>


</export>