Splunk Search

Will inputs.conf tcp input stanza accept CIDR notation or REGEX? (forwarder version 4.3.6)

the_wolverine
Champion

I have a need to accept data from multiple servers.

WIll something like this work?

[tcp://192.168.1.0\/24:9999]

If not, would specifying multiple stanza that listen on the same port number work? For example:

[tcp://192.168.1.1:9999]
[tcp://192.168.1.2:9999]
[tcp://192.168.1.3:9999]
0 Karma
1 Solution

the_wolverine
Champion

In version 5.0* and higher, there is an acceptFrom option which will allow/deny specific hosts/ips. The solution is to upgrade to version 5.0x forwarder or newer to apply this configuration to the input.

View solution in original post

0 Karma

the_wolverine
Champion

In version 5.0* and higher, there is an acceptFrom option which will allow/deny specific hosts/ips. The solution is to upgrade to version 5.0x forwarder or newer to apply this configuration to the input.

0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

I think you're going to have to go with a stanza per host that you're expecting traffic from.

0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

the_wolverine,

I don't think Splunk will accept CIDR notation (or a wildcard) in a tcp input stanza. The second option you listed should work though.

Also, if you don't expect any other traffic on port 9999, you can also just do:

[tcp//:9999]

which will accept data from any host on port 9999.

the_wolverine
Champion

We currently use this accept all on port 9999 and have gotten some junk (perhaps scanning). That's why we need to lock it down. In 5.0x the capability to configure is better.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...