splunk-connect-for-syslog
splunk-connect-for-syslog copied to clipboard
Capture source IP
Is there a way for SC4S to capture the source IP and store it in a field? I saw that in the "compliance_meta_by_source.csv" file you can use syslog-ng macros, and I saw that syslog-ng has a SOURCEIP macro, but I can not find an example of how to use a macro in the csv file. Would the line needed just be:
f_test_test,fields.sourceIP,${SOURCEIP}
and that would add a field named "sourceIP" containing the IP of the sending device?