Getting Data In

Identify IP address from host

rameshlpatel
Communicator

Hi,

We are seeing two suspicious servers which are sending syslogs in huge count.

and Upto my knowledge, we didn’t setup these two servers with forwarders or any splunk setup.

So how we can find out original servers which are sending logs to indexer ?

Tags (2)
0 Karma

linu1988
Champion

Use Deploy Monitor app(All Forwarder View) for checking which are the forwarders sending data.

In inputs.conf mention the ip address which should only be accepted from.

acceptFrom = <network_acl> ...
* Lists a set of networks or addresses to accept connections from.
 These rules are separated by commas or spaces
* Each rule can be in the following forms:
*   1. A single IPv4 or IPv6 address (examples: "10.1.2.3", "fe80::4a3")
*   2. A CIDR block of addresses (examples: "10/8", "fe80:1234/32")

Thanks

0 Karma

lukejadamec
Super Champion

If you have configured Splunk to listen to udp:514, then you did configure Splunk to collect data on any server that sends syslog data on udp:514.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you browse the syslog, you should be able to see host field. You can get IP of the server by doing nslookup.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...