This message originated from Cribl Community Slack.
Click here to view the original link.
Hi, is it possible to capture the originating IP for syslog sources? My customer has a specific requirement.
Solved
Syslog Sources Not Capturing Originating IP Address
Best answer by xpac
you already do, capture some events, click the little wheel icon, select "show internal fields", there's one called
View original__SyslogIpPort or the like... it has the client IP
you already do, capture some events, click the little wheel icon, select "show internal fields", there's one called
__SyslogIpPort or the like... it has the client IPyou can then extract/eval that to whatever non-internal field (internal = starting with
__ ) you wishSign up
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.