Getting Data In

How do I route based on host and source type?

lukessi
Path Finder

Hi,

I am routing traffic to a 3rd party. I have done some of this based on a host and others based on the source type.

But I now need to route based on a host and a sourcetype and I can't work out how to do it?

Any tips of where to look?

0 Karma
1 Solution

FrankVl
Ultra Champion

I think you could do something along these lines, triggering the transforms based on sourcetype, but inside the transforms config filter by host using the REGEX.

props.conf:

[yoursourcetype]
TRANSFORMS-setrouting = your-routing

transforms.conf

[your-routing]
SOURCE_KEY = MetaData:Host
REGEX = (host1|host2|...|hostn)
DEST_KEY = _TCP_ROUTING
FORMAT = your-outputgroup

View solution in original post

FrankVl
Ultra Champion

I think you could do something along these lines, triggering the transforms based on sourcetype, but inside the transforms config filter by host using the REGEX.

props.conf:

[yoursourcetype]
TRANSFORMS-setrouting = your-routing

transforms.conf

[your-routing]
SOURCE_KEY = MetaData:Host
REGEX = (host1|host2|...|hostn)
DEST_KEY = _TCP_ROUTING
FORMAT = your-outputgroup

lukessi
Path Finder

Cheers mate I came to that solution too. Just double checking if there was another way.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...