Splunk Dev

Filter by host on source syslog

bizza
Path Finder

My scenario:

  • splunk server listening on 514/udp (syslog).
  • many hosts/appliance send log over udp to splunk indexer.

My goal was:

  • filter source by ip/hostname, set custom sourcetype and index
  • drop every upd packet not listed in my custom rules

What is the best way to do this?

Regards

bizza

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi bizza

you can find everything you need to know about routing and filtering data in this doc here

regards

View solution in original post

MuS
Legend

Hi bizza

you can find everything you need to know about routing and filtering data in this doc here

regards

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...