Here is what I am trying to accomplish. We have our wireless controllers forwarding syslog information to splunk, this works quite well. I now want Splunk to forward part of the syslog message(user name and IP address) to our Palo Alto panorama virtual machine(10.0.2.10) which in turn will send it off to our Palo Alto firewall. When I run the following search in the Palo Alto app I get an error index=main sourcetype=syslog rename "user account" AS addruser | rename "IP address" AS addrip | panupdate device=”10.0.2.10” devicegroup=”PA-grp” the error I get is --> External search command 'panupdate' returned error code -1. can someone add any insight. thanks in advance, GMF ... View more

Hello All, I have setup splunk as a syslog receiver from a test wireless controller. this is working great. Next, I have a vbs script that look for information in the syslog message, ie user. I then want syslog to send that information to another device. Questions: a) if I define my vbs script under ...data inputs....scripts. Assuming the script is correctly written, parse the syslog information and send it to another security device? b) Do I have to define a forwarder for this to work? thank you all in advance, GMF ... View more