Hi guys,
I'm monitoring external Web Server logs and want to run an Alert detecting errors caused by other IP addresses than my own WAN IP assigned from my Internet provider.
Though, I thought I'd run a script during index-time for sourcetype "http:errors:linux" that gives back just my external IP into new/additional field "own_wan_ip". This needs to be done at index-time and not at search time as external IP changes quite often leading to wrong "own_wan_ip" when adding at search time.
My python mini-script:
#!/usr/bin/env python3
import os
os.system('dig +short txt ch whoami.cloudflare @1.0.0.1')
I tried to find some solution in Splunk's documentation like this https://docs.splunk.com/Documentation/Splunk/8.2.7/Data/Configureindex-timefieldextraction but there's only regex-based creation.
If anyone could provide me a solution for this i'd really be happy.
Thanks in advance 🙂
Splunk doesn't run scripts or external commands at index time, probably out of concern for performance.
Consider ingesting the data with a modular input (which can insert the IP address) or use Cribl to insert the IP address before the data gets to the indexers.
Not that what I'd like to read but... 🙂
Thanks for helping anyway,
Ekke
Splunk doesn't run scripts or external commands at index time, probably out of concern for performance.
Consider ingesting the data with a modular input (which can insert the IP address) or use Cribl to insert the IP address before the data gets to the indexers.