topic Re: How to add own WAN IP using a script in Getting Data In

How to add own WAN IP using a script?

eherbst63 — Mon, 24 Oct 2022 13:24:28 GMT

Hi guys,

I'm monitoring external Web Server logs and want to run an Alert detecting errors caused by other IP addresses than my own WAN IP assigned from my Internet provider.

Though, I thought I'd run a script during index-time for sourcetype "http:errors:linux" that gives back just my external IP into new/additional field "own_wan_ip". This needs to be done at index-time and not at search time as external IP changes quite often leading to wrong "own_wan_ip" when adding at search time.

My python mini-script:

#!/usr/bin/env python3
import os
os.system('dig +short txt ch whoami.cloudflare @1.0.0.1')

I tried to find some solution in Splunk's documentation like this https://docs.splunk.com/Documentation/Splunk/8.2.7/Data/Configureindex-timefieldextraction but there's only regex-based creation.

If anyone could provide me a solution for this i'd really be happy.
Thanks in advance 🙂

Re: How to add own WAN IP using a script

richgalloway — Mon, 24 Oct 2022 12:44:47 GMT

Splunk doesn't run scripts or external commands at index time, probably out of concern for performance.

Consider ingesting the data with a modular input (which can insert the IP address) or use Cribl to insert the IP address before the data gets to the indexers.

Re: How to add own WAN IP using a script?

eherbst63 — Mon, 24 Oct 2022 13:44:15 GMT

Not that what I'd like to read but... 🙂
Thanks for helping anyway,

Ekke