splunk-connect-for-syslog icon indicating copy to clipboard operation
splunk-connect-for-syslog copied to clipboard

Capture source IP

Open buzzard192 opened this issue 2 years ago • 0 comments

Is there a way for SC4S to capture the source IP and store it in a field? I saw that in the "compliance_meta_by_source.csv" file you can use syslog-ng macros, and I saw that syslog-ng has a SOURCEIP macro, but I can not find an example of how to use a macro in the csv file. Would the line needed just be:

f_test_test,fields.sourceIP,${SOURCEIP}

and that would add a field named "sourceIP" containing the IP of the sending device?

buzzard192 avatar Jan 10 '23 03:01 buzzard192