This value applies in the following situations:
For logs generated in a PAN-OS release that does not support the session end reason field (releases older than 6.1), the value will be unknown after an upgrade to the current PAN-OS release or after the logs are loaded onto the firewall.
In Panorama, logs received from firewalls for which the PAN-OS version does not support session end reasons will have a value of unknown.