topic Re: Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6) in Splunk Search

Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6)

the_wolverine — Wed, 10 Jul 2013 23:13:06 GMT

I have a need to accept data from multiple servers.

WIll something like this work?

[tcp://192.168.1.0\/24:9999]

If not, would specifying multiple stanza that listen on the same port number work? For example:

[tcp://192.168.1.1:9999]
[tcp://192.168.1.2:9999]
[tcp://192.168.1.3:9999]

Re: Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6)

mloven_splunk — Thu, 11 Jul 2013 01:41:35 GMT

the_wolverine,

I don't think Splunk will accept CIDR notation (or a wildcard) in a tcp input stanza. The second option you listed should work though.

Also, if you don't expect any other traffic on port 9999, you can also just do:

[tcp//:9999]

which will accept data from any host on port 9999.

Re: Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6)

the_wolverine — Thu, 11 Jul 2013 21:59:32 GMT

We currently use this accept all on port 9999 and have gotten some junk (perhaps scanning). That's why we need to lock it down. In 5.0x the capability to configure is better.

Re: Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6)

mloven_splunk — Fri, 12 Jul 2013 02:28:53 GMT

I think you're going to have to go with a stanza per host that you're expecting traffic from.

Re: Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6)

the_wolverine — Sat, 05 Dec 2015 18:50:03 GMT

In version 5.0* and higher, there is an acceptFrom option which will allow/deny specific hosts/ips. The solution is to upgrade to version 5.0x forwarder or newer to apply this configuration to the input.