Getting Data In

Filter Origin from LEA_OPSEC Input

simuvid
Splunk Employee
Splunk Employee

Hi all,

I have posted a similar question before, but I think I was not specific enough.

What I mean is, when getting events as a data input from Checkpoint Devices, include by using LEA_OPSEC, all of these events are listed and shown as one host and source. In the events listing I see multiple different origins of the events, so my question is:

Is there a possibility to filter these different origins, before indexing them, to display them by as source or host related to their origin?

Hope that is a bit clearer 🙂

Cheers,

Christian

Tags (2)
0 Karma
1 Solution

mmletzko
Path Finder

Christian,

You can add a "host = " line in your /opt/splunk/etc/system/local/inputs.conf file. It would look something like this:

[script:/opt/splunk/etc/apps/lea-loggrabber-xxx_xxx/bin/lea-loggrabber.sh]
host = xxx_xxx
interval = 60
sourcetype = opsec
disabled = false

After making the change, stop/start splunk and you should see the host now showing up instead of the name of the box this is configured on.

-Matt

View solution in original post

0 Karma

mmletzko
Path Finder

Christian,

You can add a "host = " line in your /opt/splunk/etc/system/local/inputs.conf file. It would look something like this:

[script:/opt/splunk/etc/apps/lea-loggrabber-xxx_xxx/bin/lea-loggrabber.sh]
host = xxx_xxx
interval = 60
sourcetype = opsec
disabled = false

After making the change, stop/start splunk and you should see the host now showing up instead of the name of the box this is configured on.

-Matt

0 Karma

simuvid
Splunk Employee
Splunk Employee

Thanks for your reply!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...