Splunk Search

Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6)

the_wolverine
Champion

I have a need to accept data from multiple servers.

WIll something like this work?

[tcp://192.168.1.0\/24:9999]

If not, would specifying multiple stanza that listen on the same port number work? For example:

[tcp://192.168.1.1:9999]
[tcp://192.168.1.2:9999]
[tcp://192.168.1.3:9999]
0 Karma
1 Solution

the_wolverine
Champion

In version 5.0* and higher, there is an acceptFrom option which will allow/deny specific hosts/ips. The solution is to upgrade to version 5.0x forwarder or newer to apply this configuration to the input.

View solution in original post

0 Karma

the_wolverine
Champion

In version 5.0* and higher, there is an acceptFrom option which will allow/deny specific hosts/ips. The solution is to upgrade to version 5.0x forwarder or newer to apply this configuration to the input.

View solution in original post

0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

I think you're going to have to go with a stanza per host that you're expecting traffic from.

0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

the_wolverine,

I don't think Splunk will accept CIDR notation (or a wildcard) in a tcp input stanza. The second option you listed should work though.

Also, if you don't expect any other traffic on port 9999, you can also just do:

[tcp//:9999]

which will accept data from any host on port 9999.

the_wolverine
Champion

We currently use this accept all on port 9999 and have gotten some junk (perhaps scanning). That's why we need to lock it down. In 5.0x the capability to configure is better.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.