Monitoring of UF Connectivity on port 9997 to Non Splunk Destinations

[mel_arce]

Hi  There,
 

  Good day , 

Is there a SPL based set up to look for UF connectivity on port 9997 to Non Splunk Destinations.
And is there any documentation in splunk finding what IP addresses splunk cloud uses or if splunk has allocated IP address range.

Thanks in advance for the help and support.

[richgalloway]

If your firewall and/or network monitoring tools report connection into Splunk then it should an easy matter to query for connections to dest_port=9997 and dest_ip!=*.splunkcloud.com.

Splunk Cloud does not publish IP addresses.

[mel_arce]

Thanks Richgalloway for the updates, appreciate it.  However, I’m not quite sure what is the dest_ip in the sample logs I gathered so far. Can you check and confirm if the dest_ip in the sample internal logs is same as the lastIndexer field as I do not see dest_ip field in my sample SPL query below:

Search:  index=_internal source=*metrics.log* group=tcpin_connections os=* uf destPort=9997

Sample Result (IP value masked):
01-27-2022 15:23:05.555 +0000 INFO  Metrics - group=tcpin_connections, ingest_pipe=1, zz.zz.zz.zz:54598:9997, connectionType=cookedSSL, sourcePort=54598, sourceHost=zz.zz.zz.zz, sourceIp=zz.zz.zz.zz, destPort=9997, kb=11.879, _tcp_Bps=391.929, _tcp_KBps=0.383, _tcp_avg_thruput=0.829, _tcp_Kprocessed=30.397, _tcp_eps=0.580, _process_time_ms=0, evt_misc_kBps=0.000, evt_raw_kBps=0.290, evt_fields_kBps=0.032, evt_fn_kBps=0.000, evt_fv_kBps=0.032, evt_fn_str_kBps=0.000, evt_fn_meta_dyn_kBps=0.000, evt_fn_meta_predef_kBps=0.000, evt_fn_meta_str_kBps=0.000, evt_fv_num_kBps=0.000, evt_fv_str_kBps=0.032, evt_fv_predef_kBps=0.000, evt_fv_offlen_kBps=0.000, evt_fv_fp_kBps=0.000, build=06d57c595b80, version=7.2.3, os=Linux, arch=x86_64, hostname=abc.com, guid=B6BDE37F-7F82-465F-9393-88C586D69485, fwdType=uf, ssl=true, lastIndexer="xx.xx.xx.xx:9997,yy.yy.yy.yy:9997", ack=false

[richgalloway]

That event is neither a firewall nor a network device event.  It's reported by a Splunk instance when it receives data on a TCP connection.  It doesn't address the question of UFs sending to non-Splunk servers.

The UF should be logging its connections.  Try

index=_internal sourcetype=splunkd host=foo TcpOutputProc

[mel_arce]

Thank you Richgalloway. Will try this and will check the outputed results, will keep you posted then. Appreciate much for you kind assistance.