Getting Data In

Route data to separate index based on CIDR

IngloriousSplun
Communicator

I have a requirement to route data that falls within two /24 CIDR ranges to a separate index, say 10.0.1.0/24 and 10.0.2.0/24. The event traffic does not come from a specific host, however, all of our traffic does aggregate to a common heavy forwarder. The events coming in are either XML or syslog and each has a specific field that displays the IP, either source or destination such as or .

My thought was to use transforms.conf and props.conf to route the traffic, but I'm not sure how to specify to only route to this index if the IP falls within the two desired /24 CIDR blocks.

Thanks.

0 Karma

IngloriousSplun
Communicator

This is what I came up with, but not sure if this is going to work:

props.conf

[netblock1-ingress]
TRANSFORMS-route = netblock1-ingress

[netblock1-egress]
TRANSFORMS-route = netblock1-egress

[netblock2-ingress]
TRANSFORMS-route = netblock2-ingress

[netblock2-egress]
TRANSFORMS-route = netblock2-egress

transforms.conf

[netblock1-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock1-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

This is what my raw event looks like for XML:

<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="..." xmlns="..." xmlns:xsi="...">
  <alert id="12345" name="test-alert">
    <details ...>
      <content>
      </content>
    </details>
    <src vlan="1">
      <ip>10.0.1.25</ip>
      <port></port>
    </src>
    <dst>
      <ip>1.2.4.5</ip>
      <port></port>
    </dst>
  </alert>
</alerts>


    <?xml version="1.0" encoding="utf-8"?>
    <alerts appliance="..." xmlns="..." xmlns:xsi="...">
      <alert id="12345" name="test-alert">
        <details ...>
          <content>
          </content>
        </details>
        <src vlan="1">
          <ip>1.2.4.5</ip>
          <port></port>
        </src>
        <dst>
          <ip>10.0.1.25</ip>
          <port></port>
        </dst>
      </alert>
    </alerts>

Thoughts?

0 Karma

JasonCarter80
Explorer

Did you get this working?

0 Karma

shan_santosh
Explorer

How can I implement the same logic for host. I want to route the events to different indexes based on source and host name. Any suggestion?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...