All Apps and Add-ons

Splunk App for Stream: proxy detection and mapping original source ip

kwchang_splunk
Splunk Employee
Splunk Employee

Hello experts,
My customer has a following requirement.

  When there is a HTTP header like "X-Forwarded-For" or "X-Cluster-IP", this HTTP request is using a proxy server. In this case, the src_ip should be set with the value of the original machine's ip (not with the proxy's ip). 

Using stream, how can I do this? How can I know the original machine's ip?

Tags (1)
0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi kwchang,

Stream replaces the proxy ip with the X-Forwarded-For value (but not the X-Cluster-IP one) for the src_ip field in HTTP events. See the src_ip field description in the http stream config page.

HTH

View solution in original post

vshcherbakov_sp
Splunk Employee
Splunk Employee

Hi kwchang,

Stream replaces the proxy ip with the X-Forwarded-For value (but not the X-Cluster-IP one) for the src_ip field in HTTP events. See the src_ip field description in the http stream config page.

HTH

kwchang_splunk
Splunk Employee
Splunk Employee

Thank you HTH.
I didn't know the meaning of "X-Forwarded_For" header. It's for the original client ip. Right? Thank you for clarification.
Regarding "X-Cluster-Client-IP" ("X-Cluster-IP" seems like a typo from my customer), I think I can do similarly in my search.
BTW, can I get those "X-*" headers which was not listed in the doc?

0 Karma

grijhwani
Motivator

X-Forwarded-For keeps a record of the remote IP that the proxy has replaced with its own when routing the packet internally.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...