All Apps and Add-ons

Splunk App for Stream: proxy detection and mapping original source ip

kwchang_splunk
Splunk Employee
Splunk Employee

Hello experts,
My customer has a following requirement.

  When there is a HTTP header like "X-Forwarded-For" or "X-Cluster-IP", this HTTP request is using a proxy server. In this case, the src_ip should be set with the value of the original machine's ip (not with the proxy's ip). 

Using stream, how can I do this? How can I know the original machine's ip?

Tags (1)
0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi kwchang,

Stream replaces the proxy ip with the X-Forwarded-For value (but not the X-Cluster-IP one) for the src_ip field in HTTP events. See the src_ip field description in the http stream config page.

HTH

View solution in original post

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi kwchang,

Stream replaces the proxy ip with the X-Forwarded-For value (but not the X-Cluster-IP one) for the src_ip field in HTTP events. See the src_ip field description in the http stream config page.

HTH

kwchang_splunk
Splunk Employee
Splunk Employee

Thank you HTH.
I didn't know the meaning of "X-Forwarded_For" header. It's for the original client ip. Right? Thank you for clarification.
Regarding "X-Cluster-Client-IP" ("X-Cluster-IP" seems like a typo from my customer), I think I can do similarly in my search.
BTW, can I get those "X-*" headers which was not listed in the doc?

0 Karma

grijhwani
Motivator

X-Forwarded-For keeps a record of the remote IP that the proxy has replaced with its own when routing the packet internally.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...