Missing Source IP address when logs are forwarded to third-party from our Splunk Heavy Forwarders. How to fix this?

[dmenon84]

Hi,

We are forwarding some of our logs from Splunk to a third party IBM Qradar environment. The third party is not able to see the actual source IP address of the logs - they only see our heavy forwarder IPs as the source. Is there something we can do on the configs on Splunk to actually include this info as well?

Here are my configs

props.conf

[pan*]
TRANSFORMS-routing=syslogRouting
#
[Win*]
TRANSFORMS-routing=syslogRouting2

transforms.conf

[syslogRouting]
REGEX=.
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslogGroup

[syslogRouting2]
REGEX=.
DEST_KEY=_SYSLOG_ROUTING
FORMAT=syslogGroup2

outputs.conf

[syslog:syslogGroup]
server = 1.2.3.4:514
sendCookedData = false

[syslog:syslogGroup2]
server = 5.6.7.8:514
sendCookedData = false

Thanks in advance !

[hunters_splunk]

Hi, dmenon84,

You can set rewrite the metadata per-event based on the actual host info in your log file on your heavy forwarder.
Suppose you have the following raw data:
[22/Apr/2014:00:46:27] sales accepted server:A01R2 SID=107570
[22/Apr/2014:00:48:40] sales rejected server:B13R1 SID=102498
[22/Apr/2014:00:50:02] sales accepted server:A05R1 SID=173560

You can add the following stanzas:
props.conf
[sales_entries]
TRANSFORMS-register = sales_host

transforms.conf
[sales_host]
SOURCE_KEY = _raw
REGEX = server:(\w+)
DEST_KEY = MetaData:Host
FORMAT = host::$1

Splunk will then check each event in the _raw source. If an event contains “server:”, capture the wordand rewrite the value of the MetaData:Host key
with the captured group.

You can also rewrite other metadata. When MetaData: key is used, its FORMAT value
must be prefixed by:
host::
source::
sourcetype::

Hope this helps. Thanks!
Hunter