Splunk App for Stream: proxy detection and mapping original source ip

[kwchang_splunk]

Hello experts,
My customer has a following requirement.

  When there is a HTTP header like "X-Forwarded-For" or "X-Cluster-IP", this HTTP request is using a proxy server. In this case, the src_ip should be set with the value of the original machine's ip (not with the proxy's ip). 

Using stream, how can I do this? How can I know the original machine's ip?

[vshcherbakov_sp · Accepted solution]

Hi kwchang,

Stream replaces the proxy ip with the X-Forwarded-For value (but not the X-Cluster-IP one) for the src_ip field in HTTP events. See the src_ip field description in the http stream config page.

HTH

[kwchang_splunk]

Thank you HTH.
I didn't know the meaning of "X-Forwarded_For" header. It's for the original client ip. Right? Thank you for clarification.
Regarding "X-Cluster-Client-IP" ("X-Cluster-IP" seems like a typo from my customer), I think I can do similarly in my search.
BTW, can I get those "X-*" headers which was not listed in the doc?

[grijhwani]

X-Forwarded-For keeps a record of the remote IP that the proxy has replaced with its own when routing the packet internally.