diff --git a/package/etc/conf.d/filters/checkpoint/splunk.conf b/package/etc/conf.d/filters/checkpoint/splunk.conf
index 0bbb3f6..ea3ff3c 100644
--- a/package/etc/conf.d/filters/checkpoint/splunk.conf
+++ b/package/etc/conf.d/filters/checkpoint/splunk.conf
@@ -1,8 +1,8 @@
 filter f_checkpoint_splunk {
     match('\|(?:origin_sic_name|originsicname)\=[cC][nN]|\|product\=SmartConsole\|' value("MSG") type("pcre")) or
     match('\|(?:origin_sic_name|originsicname)\=[cC][nN]|\|product\=SmartConsole\|' value("LEGACY_MSGHDR") type("pcre")) or
-    match('|product=Syslog|ifdir=inbound|loguid=' value("MSG") type("glob")) or
-    match('|product=Syslog|ifdir=inbound|loguid=' value("LEGACY_MSGHDR") type("glob"));
+    match('\|product=Syslog\|ifdir=inbound\|loguid=' value("MSG")) or
+    match('\|product=Syslog\|ifdir=inbound\|loguid=' value("LEGACY_MSGHDR"));
 };
 
 filter f_checkpoint_splunk_alerts {