Getting Data In

Route data to separate index based on CIDR

IngloriousSplun
Communicator

I have a requirement to route data that falls within two /24 CIDR ranges to a separate index, say 10.0.1.0/24 and 10.0.2.0/24. The event traffic does not come from a specific host, however, all of our traffic does aggregate to a common heavy forwarder. The events coming in are either XML or syslog and each has a specific field that displays the IP, either source or destination such as or .

My thought was to use transforms.conf and props.conf to route the traffic, but I'm not sure how to specify to only route to this index if the IP falls within the two desired /24 CIDR blocks.

Thanks.

0 Karma

IngloriousSplun
Communicator

This is what I came up with, but not sure if this is going to work:

props.conf

[netblock1-ingress]
TRANSFORMS-route = netblock1-ingress

[netblock1-egress]
TRANSFORMS-route = netblock1-egress

[netblock2-ingress]
TRANSFORMS-route = netblock2-ingress

[netblock2-egress]
TRANSFORMS-route = netblock2-egress

transforms.conf

[netblock1-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock1-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

This is what my raw event looks like for XML:

<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="..." xmlns="..." xmlns:xsi="...">
  <alert id="12345" name="test-alert">
    <details ...>
      <content>
      </content>
    </details>
    <src vlan="1">
      <ip>10.0.1.25</ip>
      <port></port>
    </src>
    <dst>
      <ip>1.2.4.5</ip>
      <port></port>
    </dst>
  </alert>
</alerts>


    <?xml version="1.0" encoding="utf-8"?>
    <alerts appliance="..." xmlns="..." xmlns:xsi="...">
      <alert id="12345" name="test-alert">
        <details ...>
          <content>
          </content>
        </details>
        <src vlan="1">
          <ip>1.2.4.5</ip>
          <port></port>
        </src>
        <dst>
          <ip>10.0.1.25</ip>
          <port></port>
        </dst>
      </alert>
    </alerts>

Thoughts?

0 Karma

JasonCarter80
Explorer

Did you get this working?

0 Karma

shan_santosh
Explorer

How can I implement the same logic for host. I want to route the events to different indexes based on source and host name. Any suggestion?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...