Hello, total noob looking for some help. I installed edge/stream on Rocky 8. It is running, but I am having trouble figuring out how to manipulate data in a source.The source is syslogng, destination is splunk. I want to take the data from the source, do a reverse lookup of the IP that sent the data, then replace the system name or add a field with the result from the reverse lookup.The reasoning behind this is that the syslog senders are part of a virtualization cluster, but each cluster re-uses the name(s) "node(X)" internally, so within splunk there's duplicate entries from each cluster. A reverse lookup should give us unique names for splunk
Question
Looking to enrich my data by doing a reverse ip lookup and setting that as the source
+1So you are sending syslog-ng to Stream and then to Splunk? There is a DNS Lookup function you can add inside a pipeline and then provide the field you want to reverse DNS lookup on
Quick version:Create a syslog source (Data -> Sources)Create a pipeline with the functions you needCreate a route referencing the __inputId for your syslog source
probably best to visit our https://sandbox.cribl.io|sandboxes though, and take a few 30 min courses to familiarize yourself
check internal fields for the connecting ip
I was messing with the DNS lookup, after doing a data capture I couldn't find a field that had the IP address
0
hrmmm.... doesn't look the same
0
ahhh, wait...
found it
gracias
Since the one field with info has extraneous data, I'm guessing I'll need to regex it first to filter just the IP? Would that be correct?
0
evalip = `__srcIpPort.split('|')[1]`
badabing!
sweeeeeeet
muchas gracias senior
+1That's just good stuff
Sign up
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.