How to configure HTTP Event collector to log client/source IP?

[mbintz]

My team has a growing interest in looking at geo location as a function of client IP address. I've installed a plugin to help with this, but I was a bit stunned to realize that none of my HEC records have the client's IP address (or the source IP) in them.

Is there a way to configure Splunk so that it records the client IP in the record metadata? I would like the server to obtain this information from the HTTP connection rather than have the clients report this information voluntarily since most of my clients won't know their actual WAN IP address (they're behind firewalls).

I see that my HEC records have "splunk_server" in them which is kinda' funny since (it seems to me) that Splunkers would be far more interested in the ORIGIN of the record rather than DESTINATION of the record.

[gblock_splunk · Accepted solution]

Hi @mbintz

Great to hear you are using HEC. By default the host will be the host set to the server host. To change this you can set the connection_host setting in etc\apps\splunk_httpinput\inputs.conf. It will allow you to select to use the client IP. You can set this either globally at the [http] stanza level or for each individual token within the token stanza.

Here is the setting from inputs.conf.spec

connection_host = [ip|dns|none]
* Specify the host if an event doesn't have host set.
* "ip" sets the host to the IP address of the system sending the data.
* "dns" sets the host to the reverse DNS entry for IP address of the system sending the data.
* "none" leaves the host as specified in the HTTP header.

The default is none.

[Akeydel]

I have been receiving HTTP Events from an invalid token, and want to trace them back to the source.

However, the HEC is behind an NGINX load-balancer, so I need to configure the HEC to use proxied_ip to find the original IP. 

connection_host = [ip|dns|proxied_ip|none]
* "proxied_ip" checks whether an X-Forwarded-For header was sent
  (presumably by a proxy server) and if so, sets the host to that value.
  Otherwise, the IP address of the system sending the data is used.
* No default. 

I would also like to apply it to every token, as all HEC ingest goes through the LB.

However, it looks like this option is only available at a per-token level.
HTTP Event Collector (HEC) - Local stanza for each token | inputs.conf 
Nothing changed when I set it under [http] 

Seems like this was implemented incorrectly...

[mbintz]

The per-token settings sounds perfect. It'd be great if that were settable in the GUI.

[gblock_splunk]

Good suggestion, I will file it.

Thanks!

[catalina4]

Was this feature added onto the UI?