Getting Data In

Route data to separate index based on CIDR

IngloriousSplun
Communicator

I have a requirement to route data that falls within two /24 CIDR ranges to a separate index, say 10.0.1.0/24 and 10.0.2.0/24. The event traffic does not come from a specific host, however, all of our traffic does aggregate to a common heavy forwarder. The events coming in are either XML or syslog and each has a specific field that displays the IP, either source or destination such as or .

My thought was to use transforms.conf and props.conf to route the traffic, but I'm not sure how to specify to only route to this index if the IP falls within the two desired /24 CIDR blocks.

Thanks.

0 Karma

IngloriousSplun
Communicator

This is what I came up with, but not sure if this is going to work:

props.conf

[netblock1-ingress]
TRANSFORMS-route = netblock1-ingress

[netblock1-egress]
TRANSFORMS-route = netblock1-egress

[netblock2-ingress]
TRANSFORMS-route = netblock2-ingress

[netblock2-egress]
TRANSFORMS-route = netblock2-egress

transforms.conf

[netblock1-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock1-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.1\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-ingress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

[netblock2-egress]
SOURCE_KEY = _raw
REGEX = (?m)(?:.*\<ip\>)(10\.0\.2\.[0-9]{1,3})
FORMAT = myIndex
DEST_KEY = _MetaData:Index

This is what my raw event looks like for XML:

<?xml version="1.0" encoding="utf-8"?>
<alerts appliance="..." xmlns="..." xmlns:xsi="...">
  <alert id="12345" name="test-alert">
    <details ...>
      <content>
      </content>
    </details>
    <src vlan="1">
      <ip>10.0.1.25</ip>
      <port></port>
    </src>
    <dst>
      <ip>1.2.4.5</ip>
      <port></port>
    </dst>
  </alert>
</alerts>


    <?xml version="1.0" encoding="utf-8"?>
    <alerts appliance="..." xmlns="..." xmlns:xsi="...">
      <alert id="12345" name="test-alert">
        <details ...>
          <content>
          </content>
        </details>
        <src vlan="1">
          <ip>1.2.4.5</ip>
          <port></port>
        </src>
        <dst>
          <ip>10.0.1.25</ip>
          <port></port>
        </dst>
      </alert>
    </alerts>

Thoughts?

0 Karma

JasonCarter80
Explorer

Did you get this working?

0 Karma

shan_santosh
Explorer

How can I implement the same logic for host. I want to route the events to different indexes based on source and host name. Any suggestion?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...