How to configure HTTP Event collector to log client/source IP?

[mbintz]

My team has a growing interest in looking at geo location as a function of client IP address. I've installed a plugin to help with this, but I was a bit stunned to realize that none of my HEC records have the client's IP address (or the source IP) in them.

Is there a way to configure Splunk so that it records the client IP in the record metadata? I would like the server to obtain this information from the HTTP connection rather than have the clients report this information voluntarily since most of my clients won't know their actual WAN IP address (they're behind firewalls).

I see that my HEC records have "splunk_server" in them which is kinda' funny since (it seems to me) that Splunkers would be far more interested in the ORIGIN of the record rather than DESTINATION of the record.

[gblock_splunk · Accepted solution]

Hi @mbintz

Great to hear you are using HEC. By default the host will be the host set to the server host. To change this you can set the connection_host setting in etc\apps\splunk_httpinput\inputs.conf. It will allow you to select to use the client IP. You can set this either globally at the [http] stanza level or for each individual token within the token stanza.

Here is the setting from inputs.conf.spec

connection_host = [ip|dns|none]
* Specify the host if an event doesn't have host set.
* "ip" sets the host to the IP address of the system sending the data.
* "dns" sets the host to the reverse DNS entry for IP address of the system sending the data.
* "none" leaves the host as specified in the HTTP header.

The default is none.

[mbintz]

The per-token settings sounds perfect. It'd be great if that were settable in the GUI.

[gblock_splunk]

Good suggestion, I will file it.

Thanks!

[catalina4]

Was this feature added onto the UI?