Audit type event filter in Checkpoint

[PricklyPotato]

Hello,

I have the following syntax to filter event of type Checkpoint:firewall.

block parser app-dest-rewrite-checkpoint_drop() {
    channel {
        rewrite(r_set_dest_splunk_null_queue);
    };
};
application app-dest-rewrite-checkpoint_drop[sc4s-postfilter] {
    filter {
        match('checkpoint' value('fields.sc4s_vendor') type(string))
        and match('syslog' value('fields.sc4s_product') type(string))
        and match('checkpoint:firewall' value('.splunk.source'));
    };
    parser { app-dest-rewrite-checkpoint_drop(); };
};

It works correctly for me, but now I also want to filter Checkpoint:audit type events.

I have tried with this configuration but, now I have stopped receiving events.

block parser app-dest-rewrite-checkpoint_drop() {
    channel {
        rewrite(r_set_dest_splunk_null_queue);
    };
};
application app-dest-rewrite-checkpoint_drop[sc4s-postfilter] {
    filter {
        match('checkpoint' value('fields.sc4s_vendor') type(string))
        and match('syslog' value('fields.sc4s_product') type(string))
        and (
            match('checkpoint:firewall' value('.splunk.source'))
            or
            match('checkpoint:audit' value('.splunk.source'))
        );
    };
    parser { app-dest-rewrite-checkpoint_drop(); };
};

Can anyone come up with any ideas?

Thank you very much.

[PricklyPotato]

Con esa configuracion funciona correctamente.
Cerramos la