How to add own WAN IP using a script?

[eherbst63]

Hi guys,

I'm monitoring external Web Server logs and want to run an Alert detecting errors caused by other IP addresses than my own WAN IP assigned from my Internet provider.

Though, I thought I'd run a script during index-time for sourcetype "http:errors:linux" that gives back just my external IP into new/additional field "own_wan_ip". This needs to be done at index-time and not at search time as external IP changes quite often leading to wrong "own_wan_ip" when adding at search time.

My python mini-script:

#!/usr/bin/env python3
import os
os.system('dig +short txt ch whoami.cloudflare @1.0.0.1')

I tried to find some solution in Splunk's documentation like this https://docs.splunk.com/Documentation/Splunk/8.2.7/Data/Configureindex-timefieldextraction but there's only regex-based creation.

If anyone could provide me a solution for this i'd really be happy.
Thanks in advance 🙂

[eherbst63]

Not that what I'd like to read but... 🙂
Thanks for helping anyway,

Ekke

[richgalloway · Accepted solution]

Splunk doesn't run scripts or external commands at index time, probably out of concern for performance.

Consider ingesting the data with a modular input (which can insert the IP address) or use Cribl to insert the IP address before the data gets to the indexers.