Getting Data In

Missing Source IP address when logs are forwarded to third-party from our Splunk Heavy Forwarders. How to fix this?

dmenon84
Path Finder

Hi,

We are forwarding some of our logs from Splunk to a third party IBM Qradar environment. The third party is not able to see the actual source IP address of the logs - they only see our heavy forwarder IPs as the source. Is there something we can do on the configs on Splunk to actually include this info as well?

Here are my configs

props.conf

[pan*]
TRANSFORMS-routing=syslogRouting
#
[Win*]
TRANSFORMS-routing=syslogRouting2

transforms.conf

[syslogRouting]
REGEX=.
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslogGroup

[syslogRouting2]
REGEX=.
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslogGroup2

outputs.conf

[syslog:syslogGroup]
server = 1.2.3.4:514
sendCookedData = false

[syslog:syslogGroup2]
server = 5.6.7.8:514
sendCookedData = false

Thanks in advance !

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi, dmenon84,

You can set rewrite the metadata per-event based on the actual host info in your log file on your heavy forwarder.
Suppose you have the following raw data:
[22/Apr/2014:00:46:27] sales accepted server:A01R2 SID=107570
[22/Apr/2014:00:48:40] sales rejected server:B13R1 SID=102498
[22/Apr/2014:00:50:02] sales accepted server:A05R1 SID=173560

You can add the following stanzas:
props.conf
[sales_entries]
TRANSFORMS-register = sales_host

transforms.conf
[sales_host]
SOURCE_KEY = _raw
REGEX = server:(\w+)
DEST_KEY = MetaData:Host
FORMAT = host::$1

Splunk will then check each event in the _raw source. If an event contains “server:”, capture the wordand rewrite the value of the MetaData:Host key
with the captured group.

You can also rewrite other metadata. When MetaData: key is used, its FORMAT value
must be prefixed by:
host::
source::
sourcetype::

Hope this helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...