Getting Data In

How to configure HTTP Event collector to log client/source IP?

mbintz
Explorer

My team has a growing interest in looking at geo location as a function of client IP address. I've installed a plugin to help with this, but I was a bit stunned to realize that none of my HEC records have the client's IP address (or the source IP) in them.

Is there a way to configure Splunk so that it records the client IP in the record metadata? I would like the server to obtain this information from the HTTP connection rather than have the clients report this information voluntarily since most of my clients won't know their actual WAN IP address (they're behind firewalls).

I see that my HEC records have "splunk_server" in them which is kinda' funny since (it seems to me) that Splunkers would be far more interested in the ORIGIN of the record rather than DESTINATION of the record.

1 Solution

gblock_splunk
Splunk Employee
Splunk Employee

Hi @mbintz

Great to hear you are using HEC. By default the host will be the host set to the server host. To change this you can set the connection_host setting in etc\apps\splunk_httpinput\inputs.conf. It will allow you to select to use the client IP. You can set this either globally at the [http] stanza level or for each individual token within the token stanza.

Here is the setting from inputs.conf.spec

connection_host = [ip|dns|none]
* Specify the host if an event doesn't have host set.
* "ip" sets the host to the IP address of the system sending the data.
* "dns" sets the host to the reverse DNS entry for IP address of the system sending the data.
* "none" leaves the host as specified in the HTTP header.

The default is none.

View solution in original post

gblock_splunk
Splunk Employee
Splunk Employee

Hi @mbintz

Great to hear you are using HEC. By default the host will be the host set to the server host. To change this you can set the connection_host setting in etc\apps\splunk_httpinput\inputs.conf. It will allow you to select to use the client IP. You can set this either globally at the [http] stanza level or for each individual token within the token stanza.

Here is the setting from inputs.conf.spec

connection_host = [ip|dns|none]
* Specify the host if an event doesn't have host set.
* "ip" sets the host to the IP address of the system sending the data.
* "dns" sets the host to the reverse DNS entry for IP address of the system sending the data.
* "none" leaves the host as specified in the HTTP header.

The default is none.

mbintz
Explorer

The per-token settings sounds perfect. It'd be great if that were settable in the GUI.

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

Good suggestion, I will file it.

Thanks!

0 Karma

catalina4
Observer

Was this feature added onto the UI?

0 Karma
Get Updates on the Splunk Community!

App Building 101 - Build Your First App!

WATCH RECORDING NOW   Tech Talk: App Dev Edition Splunk has tons of out-of-the-box functionality, and you’ve ...

Introducing support for Amazon Data Firehose in Splunk Edge Processor

We’re excited to announce a powerful update to Splunk Data Management with added support for Amazon Data ...

The Observability Round-Up: September 2024

What’s up Splunk Community! Welcome to the latest edition of the Observability Round-Up, a monthly series in ...