Getting Data In

SourceType Override based on Host's IP Address

rmcdougal
Path Finder

I am attempting to override the sourcetype of an event that is coming in on UDP:516 based on the host address but I haven't had any success. This is what I have so far.

props.conf

[source::UDP:516]
TRANSFORMS = transSnort

transforms.conf

[transSnort]
REGEX="10.41.140.151"
FORMAT= sourcetype::snort
DEST_KEY = MetaData:Sourcetype

Any ideas what I am doing wrong?

Tags (2)
0 Karma

mcronkrite
Splunk Employee
Splunk Employee

You will also want to qualify the IP address of the incoming remote host as a RegEx. Examples below.
In transforms.conf create a stanza for this regex rule that sets the metadata property for indexing or sourcetype.

The metdata config setting for sourcetype is:

DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::networkdata:appliancename

The metadata config setting for index is:

DEST_KEY = _MetaData:Index
FORMAT = index::myindexname

Put the ip address list of similar sources together.
Then in props.conf reference this label.
Distribute this configuration to all tiers of Splunk deployment (Forwarding, Indexing, and Search)

See:
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Transformsconf


####### props.conf
[source::UDP:514]
TRANSFORMS = syslog_mydatasoureytpe

####### transforms.conf
### Note: You should escape your periods in the IP address too
### so you don't accidentally match 10a31b20c19
### (couldn't format post to show that. .)

# one ip address exactly
[syslog_mydatasoureytpe]
DEST_KEY = MetaData:Sourcetype
DEST_KEY = _MetaData:Index
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(10.0.0.5)[\w.-]]?\s
FORMAT = sourcetype::mydatasourcetype
FORMAT = index::myindexname

# two ip addresses
[syslog_mydatasoureytpe]
DEST_KEY = MetaData:Sourcetype
DEST_KEY = _MetaData:Index
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(10.0.0.5|10.0.0.6)[\w.-]]?\s
FORMAT = sourcetype::mydatasourcetype
FORMAT = index::myindexname

# a range of IP addresses .10-.19
[syslog_mydatasoureytpe]
DEST_KEY = MetaData:Sourcetype
DEST_KEY = _MetaData:Index
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(10.0.0.1\d)[\w.-]]?\s
FORMAT = sourcetype::mydatasourcetype
FORMAT = index::myindexname

0 Karma

Ayn
Legend

First, you don't have an identifier for your TRANSFORMS directive. I honestly do not know what behaviour this causes in Splunk - you should use an identifier (for instance "TRANSFORMS-transsnort").

Second, you've put the IP number within quotes - Splunk will match everything that follows REGEX=, including the quotes, so that's a very likely reason why it's not working.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...