Splunk as syslog --> vbs script--> security device

[flanny16]

Hello All,
I have setup splunk as a syslog receiver from a test wireless controller. this is working great.
Next, I have a vbs script that look for information in the syslog message, ie user.

I then want syslog to send that information to another device.

Questions:
a) if I define my vbs script under ...data inputs....scripts. Assuming the script is correctly written, parse the syslog information and send it to another security device?
b) Do I have to define a forwarder for this to work?

thank you all in advance,
GMF

[sbrant_splunk]

Here is an option, that is different from what you propose but potentially less complicated. There is an app on SplunkBase, called "Splunk Real-Time Output":

http://splunk-base.splunk.com/apps/48082/splunk-real-time-output

The app will allow you to create a search in Splunk, against the wireless controller data, that you are already collecting, and forward it via syslog (either UDP or TCP) to another device. This will eliminate the need to utilize vbscript and I suspect, be far easier to maintain.

[flanny16]

Thank you for this.

I am not sure if our device that we are sending to from splunk will accept syslog info but I am testing out that theory. The other option is file but again, this is unknown. Will probe our vendor for support as well.

Nice app.

GMF