Getting Data In

How do I route based on host and source type?

lukessi
Path Finder

Hi,

I am routing traffic to a 3rd party. I have done some of this based on a host and others based on the source type.

But I now need to route based on a host and a sourcetype and I can't work out how to do it?

Any tips of where to look?

0 Karma
1 Solution

FrankVl
Ultra Champion

I think you could do something along these lines, triggering the transforms based on sourcetype, but inside the transforms config filter by host using the REGEX.

props.conf:

[yoursourcetype]
TRANSFORMS-setrouting = your-routing

transforms.conf

[your-routing]
SOURCE_KEY = MetaData:Host
REGEX = (host1|host2|...|hostn)
DEST_KEY = _TCP_ROUTING
FORMAT = your-outputgroup

View solution in original post

FrankVl
Ultra Champion

I think you could do something along these lines, triggering the transforms based on sourcetype, but inside the transforms config filter by host using the REGEX.

props.conf:

[yoursourcetype]
TRANSFORMS-setrouting = your-routing

transforms.conf

[your-routing]
SOURCE_KEY = MetaData:Host
REGEX = (host1|host2|...|hostn)
DEST_KEY = _TCP_ROUTING
FORMAT = your-outputgroup

lukessi
Path Finder

Cheers mate I came to that solution too. Just double checking if there was another way.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...