Splunk Search

Segregate data base on IP Address

withool000
New Member

I am looking for the best solution for segregate data into multiple indexes.
There are IP addresses (very vary) being generated into a file which need to be segregated into a specific index.

The only way I can think of is using REGEX in transforms.conf but I am not sure how to regex the IP pattern from file.
Or there might be some better solution for this scenario.

Tags (1)
0 Karma

mcronkrite
Splunk Employee
Splunk Employee

In the inputs.conf file you can easily setup these filters at your forwarders inputs.conf.
By setting the index at the forwarder you have the least compute load on your indexers.
Use a deployment server to send custom inputs.conf to different fowarders/

Most easily just setting a value for index = foo in all the inputs.conf stanza that you want to send to foo
Then deploy this inputs.conf as an app foo/ to the fowarders that match that IP or host addreses. For the systems that you want to send to index=bar, do the same thing, create an inputs.conf that has index=bar set for all the data you want to go to bar. Then create an app called bar/ and deploy that to the hosts which should report to index=bar. Your deployment server controls what systems get Foo vs Bar app. This way to can dynamically change groups and scale your deployment without having to touch each system individually.

Check out the spec file for inputs.conf because there are many options for customizing where to send your data.
host_regex =
acceptFrom =
whitelist =
blacklist =

Check out the Getting Data In docs about white and black listing for mapping to different indexes.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Whitelistorblacklistspecificincomingdata

Check out the Routing and Data Filtering section
http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad

0 Karma

sundareshr
Legend

As simple regex for match IP would be \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b but this will match any and all IP addresses in the event. What is unique about the IP that need to be routed?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...