Can I use wildcards for IPs in inputs.conf?

[Shark2112]

Hey guys.

Can I use wildcards for IPs in inputs.conf?

I have:

[udp://10.102.1.1:514]
connection_host = ip
source = syslog
sourcetype = cisco

[udp://10.102.1.2:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco

I want:
[udp://10.102.1.\*:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco

Thx!

[gfreitas · Accepted solution]

Hi,

You can use the new option acceptFrom in inputs.conf. If that you can add acceptFrom=10.102.1.0/24. See more info here: http://docs.splunk.com/Documentation/Splunk/6.4.1/admin/inputsconf

[Shark2112]

if i understend right, with acceptFrom i cant make few stanzas with same name

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:sw
acceptFrom = 1.1.1/24, 2.2.2/24
disabled = 0

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:asa
disabled = 0
acceptFrom = 3.3.3/24

[gfreitas]

No, the acceptFrom filters results from the port but you cannot add multiple entries just with the port, Splunk will add just one of the entries. Maybe you can change ports and do smth like this:

[udp:514]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:sw
acceptFrom = 1.1.1/24, 2.2.2/24
disabled = 0

[udp:515]
connection_host = ip
source = syslog
index = main
sourcetype = cisco:asa
disabled = 0
acceptFrom = 3.3.3/24

Other options are sourcetype renaming and sourcetype configuration per-event. Usefull links: http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Renamesourcetypes and http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Advancedsourcetypeoverrides

Hope this helps

[Shark2112]

i want to use just 514 port so i write python script, thx for help