topic Re: How to configure HTTP Event collector to log client/source IP? in Getting Data In

How to configure HTTP Event collector to log client/source IP?

mbintz — Tue, 09 Feb 2016 00:07:17 GMT

My team has a growing interest in looking at geo location as a function of client IP address. I've installed a plugin to help with this, but I was a bit stunned to realize that none of my HEC records have the client's IP address (or the source IP) in them.

Is there a way to configure Splunk so that it records the client IP in the record metadata? I would like the server to obtain this information from the HTTP connection rather than have the clients report this information voluntarily since most of my clients won't know their actual WAN IP address (they're behind firewalls).

I see that my HEC records have "splunk_server" in them which is kinda' funny since (it seems to me) that Splunkers would be far more interested in the ORIGIN of the record rather than DESTINATION of the record.

Re: How to configure HTTP Event collector to log client/source IP?

gblock_splunk — Tue, 09 Feb 2016 00:40:42 GMT

Hi @mbintz

Great to hear you are using HEC. By default the host will be the host set to the server host. To change this you can set the connection_host setting in etc\apps\splunk_httpinput\inputs.conf. It will allow you to select to use the client IP. You can set this either globally at the [http] stanza level or for each individual token within the token stanza.

Here is the setting from inputs.conf.spec

connection_host = [ip|dns|none]
* Specify the host if an event doesn't have host set.
* "ip" sets the host to the IP address of the system sending the data.
* "dns" sets the host to the reverse DNS entry for IP address of the system sending the data.
* "none" leaves the host as specified in the HTTP header.

The default is none.

Re: How to configure HTTP Event collector to log client/source IP?

mbintz — Tue, 09 Feb 2016 15:52:00 GMT

The per-token settings sounds perfect. It'd be great if that were settable in the GUI.

Re: How to configure HTTP Event collector to log client/source IP?

gblock_splunk — Tue, 09 Feb 2016 16:02:45 GMT

Good suggestion, I will file it.

Thanks!

Re: How to configure HTTP Event collector to log client/source IP?

catalina4 — Thu, 26 Jan 2023 21:20:09 GMT

Was this feature added onto the UI?

Re: How to configure HTTP Event collector to log client/source IP?

Akeydel — Wed, 26 Feb 2025 20:46:53 GMT

I have been receiving HTTP Events from an invalid token, and want to trace them back to the source.

However, the HEC is behind an NGINX load-balancer, so I need to configure the HEC to use proxied_ip to find the original IP.

connection_host = [ip|dns|proxied_ip|none]
* "proxied_ip" checks whether an X-Forwarded-For header was sent
  (presumably by a proxy server) and if so, sets the host to that value.
  Otherwise, the IP address of the system sending the data is used.
* No default.

I would also like to apply it to every token, as all HEC ingest goes through the LB.

However, it looks like this option is only available at a per-token level.
HTTP Event Collector (HEC) - Local stanza for each token | inputs.conf
Nothing changed when I set it under [http]

Seems like this was implemented incorrectly...