Getting Data In

How do I parse IPv6 with collapsed zero's and IPv4 quad to just IPv4

cachexploit
Explorer

I am getting IPv6 with collapsed zero's and IPv4 quad (ie "fe80::192.168.10.100") for source and I want to parse out the IPv6 part of that field.  What do I need to add in my prop to parse that part out?  Thank you for any and all help.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@cachexploit -It seems like there is no space or any other characters between IPv6 address and IPv4 address.

For example:

2001:0db8:0001:0000:0000:0ab9:C0A8:10292.10.10.10

There could be two scenarios here:

  • IPv6=2001:0db8:0001:0000:0000:0ab9:C0A8:102 & IPv4=92.10.10.10
  • OR
  • IPv6=2001:0db8:0001:0000:0000:0ab9:C0A8:10    & IPv4=292.10.10.10

Is this what you are saying. Or Am I missing anything here?

 

0 Karma

cachexploit
Explorer

After doing some more digging it appears that the machines logging into Splunk have IPv6 enabled BUT the sources connecting to those machines do not have IPv6 enabled.  So there is the address reporting ::ffff:10.10.10.10, basically stating to the Splunk UF machine that this source is working in IPv4.  What I am looking for is how to alter the group logging of these machines so that Splunk parses them correctly and I drops the IPv6 part of this address?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...