Security

source IP field

allenhau
Engager

Hello,

I am new to splunk and have not started the evaluation yet but wanted to ask this question that may be obvious.

Let's say Firewall-1 sends logs to splunk with the source IP defined as "src IP"
Firewall-2 sends logs to splunk with source IP defined as "source IP"

Would splunk automatically place it into a common filed? If so, what would that field be called? If splunk can't place it into a common field what would an admin have to do to accomplish that?

Tags (1)
0 Karma

arjunpkishore5
Motivator

Unless you explicitly override the "host" field, it'll be part of the metadata field "host"

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...