Getting Data In

SourceType Override based on Host's IP Address

rmcdougal
Path Finder

I am attempting to override the sourcetype of an event that is coming in on UDP:516 based on the host address but I haven't had any success. This is what I have so far.

props.conf

[source::UDP:516]
TRANSFORMS = transSnort

transforms.conf

[transSnort]
REGEX="10.41.140.151"
FORMAT= sourcetype::snort
DEST_KEY = MetaData:Sourcetype

Any ideas what I am doing wrong?

Tags (2)
0 Karma

mcronkrite
Splunk Employee
Splunk Employee

You will also want to qualify the IP address of the incoming remote host as a RegEx. Examples below.
In transforms.conf create a stanza for this regex rule that sets the metadata property for indexing or sourcetype.

The metdata config setting for sourcetype is:

DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::networkdata:appliancename

The metadata config setting for index is:

DEST_KEY = _MetaData:Index
FORMAT = index::myindexname

Put the ip address list of similar sources together.
Then in props.conf reference this label.
Distribute this configuration to all tiers of Splunk deployment (Forwarding, Indexing, and Search)

See:
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Transformsconf


####### props.conf
[source::UDP:514]
TRANSFORMS = syslog_mydatasoureytpe

####### transforms.conf
### Note: You should escape your periods in the IP address too
### so you don't accidentally match 10a31b20c19
### (couldn't format post to show that. .)

# one ip address exactly
[syslog_mydatasoureytpe]
DEST_KEY = MetaData:Sourcetype
DEST_KEY = _MetaData:Index
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(10.0.0.5)[\w.-]]?\s
FORMAT = sourcetype::mydatasourcetype
FORMAT = index::myindexname

# two ip addresses
[syslog_mydatasoureytpe]
DEST_KEY = MetaData:Sourcetype
DEST_KEY = _MetaData:Index
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(10.0.0.5|10.0.0.6)[\w.-]]?\s
FORMAT = sourcetype::mydatasourcetype
FORMAT = index::myindexname

# a range of IP addresses .10-.19
[syslog_mydatasoureytpe]
DEST_KEY = MetaData:Sourcetype
DEST_KEY = _MetaData:Index
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(10.0.0.1\d)[\w.-]]?\s
FORMAT = sourcetype::mydatasourcetype
FORMAT = index::myindexname

0 Karma

Ayn
Legend

First, you don't have an identifier for your TRANSFORMS directive. I honestly do not know what behaviour this causes in Splunk - you should use an identifier (for instance "TRANSFORMS-transsnort").

Second, you've put the IP number within quotes - Splunk will match everything that follows REGEX=, including the quotes, so that's a very likely reason why it's not working.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...