Is the sourcetype pan_log or pan_logs(plural)? This is very confusing and could be the source of the problem. The index is pan_logs, correct?
... View more
alacercogitatus's answer does work, though the separators for the MetaData keys are single colons, not double, i.e.
DEST_KEY = MetaData:Sourcetype
SOURCE_KEY = MetaData:Source
After that it worked great!
... View more