Getting Data In

Can I use wildcards for IPs in inputs.conf?

Shark2112
Communicator

Hey guys.

Can I use wildcards for IPs in inputs.conf?

I have:

[udp://10.102.1.1:514]
connection_host = ip
source = syslog
sourcetype = cisco

[udp://10.102.1.2:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco

I want:
[udp://10.102.1.\*:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco

Thx!

Tags (3)
0 Karma
1 Solution

gfreitas
Builder

Hi,

You can use the new option acceptFrom in inputs.conf. If that you can add acceptFrom=10.102.1.0/24. See more info here: http://docs.splunk.com/Documentation/Splunk/6.4.1/admin/inputsconf

View solution in original post

0 Karma

gfreitas
Builder

Hi,

You can use the new option acceptFrom in inputs.conf. If that you can add acceptFrom=10.102.1.0/24. See more info here: http://docs.splunk.com/Documentation/Splunk/6.4.1/admin/inputsconf

0 Karma

Shark2112
Communicator

if i understend right, with acceptFrom i cant make few stanzas with same name

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:sw
acceptFrom = 1.1.1/24, 2.2.2/24
disabled = 0

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:asa
disabled = 0
acceptFrom = 3.3.3/24

0 Karma

gfreitas
Builder

No, the acceptFrom filters results from the port but you cannot add multiple entries just with the port, Splunk will add just one of the entries. Maybe you can change ports and do smth like this:

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:sw
acceptFrom = 1.1.1/24, 2.2.2/24
disabled = 0

[udp:515]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:asa
disabled = 0
acceptFrom = 3.3.3/24

Other options are sourcetype renaming and sourcetype configuration per-event. Usefull links: http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Renamesourcetypes and http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Advancedsourcetypeoverrides

Hope this helps

Shark2112
Communicator

i want to use just 514 port so i write python script, thx for help

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...