Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Capture source IP #1972

Open
buzzard192 opened this issue Jan 10, 2023 · 0 comments
Open

Capture source IP #1972

buzzard192 opened this issue Jan 10, 2023 · 0 comments
Labels
Application core dependency in sc4s

Comments

@buzzard192
Copy link

Is there a way for SC4S to capture the source IP and store it in a field? I saw that in the "compliance_meta_by_source.csv" file you can use syslog-ng macros, and I saw that syslog-ng has a SOURCEIP macro, but I can not find an example of how to use a macro in the csv file. Would the line needed just be:

f_test_test,fields.sourceIP,${SOURCEIP}

and that would add a field named "sourceIP" containing the IP of the sending device?

@rjha-splunk rjha-splunk added the Application core dependency in sc4s label Jan 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Application core dependency in sc4s
Projects
None yet
Development

No branches or pull requests

2 participants