topic Re: Can I use wildcards for IPs in inputs.conf? in Getting Data In

Can I use wildcards for IPs in inputs.conf?

Shark2112 — Tue, 28 Jun 2016 15:00:46 GMT

Hey guys.

Can I use wildcards for IPs in inputs.conf?

I have:

[udp://10.102.1.1:514]
connection_host = ip
source = syslog
sourcetype = cisco

[udp://10.102.1.2:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco

I want:
[udp://10.102.1.\*:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco

Thx!

Re: Can I use wildcards for IPs in inputs.conf?

gfreitas — Tue, 28 Jun 2016 19:38:29 GMT

Hi,

You can use the new option acceptFrom in inputs.conf. If that you can add acceptFrom=10.102.1.0/24. See more info here: http://docs.splunk.com/Documentation/Splunk/6.4.1/admin/inputsconf

Re: Can I use wildcards for IPs in inputs.conf?

Shark2112 — Wed, 29 Jun 2016 09:00:48 GMT

if i understend right, with acceptFrom i cant make few stanzas with same name

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:sw
acceptFrom = 1.1.1/24, 2.2.2/24
disabled = 0

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:asa
disabled = 0
acceptFrom = 3.3.3/24

Re: Can I use wildcards for IPs in inputs.conf?

gfreitas — Wed, 29 Jun 2016 13:43:15 GMT

No, the acceptFrom filters results from the port but you cannot add multiple entries just with the port, Splunk will add just one of the entries. Maybe you can change ports and do smth like this:

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:sw
acceptFrom = 1.1.1/24, 2.2.2/24
disabled = 0

[udp:515]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:asa
disabled = 0
acceptFrom = 3.3.3/24

Other options are sourcetype renaming and sourcetype configuration per-event. Usefull links: http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Renamesourcetypes and http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Advancedsourcetypeoverrides

Hope this helps

Re: Can I use wildcards for IPs in inputs.conf?

Shark2112 — Thu, 30 Jun 2016 10:32:00 GMT

i want to use just 514 port so i write python script, thx for help