Syslog FlexConnector with IPv6

[mmanring]

So I have events coming from a DNS appliance that isn't supported by ArcSight and I have made a parser for it that somewhat works. One of the issues that it is having is when the event has IPv6 addresses instead of IPv4 addresses in it. Here is the relevant piece of an IPv4 and IPv6 event:

client 192.168.34.55#61213 (hostname.test.com): query: hostname.test.com IN A + (192.168.0.5)
client 2000:152:4f46:8a::d014#50454 (ing.clicktale.net): query: ing.clicktale.net IN AAAA + (2000:152:4f46:8a::5)

The first IP address is the source and the second is the destination. So I capture them in the FlexConnector as srcip (source) and dstip (destination) and then try to assign them with the following:

event.destinationAddress=__oneOfAddress(dstip)
event.sourceAddress=__oneOfAddress(srcip)
event.deviceCustomIPv6Address2Label=__stringConstant("Source IPv6 Address")
event.deviceCustomIPv6Address2=__stringToIPv6Address(srcip)
event.deviceCustomIPv6Address3Label=__stringConstant("Destination IPv6 Address")
event.deviceCustomIPv6Address3=__stringToIPv6Address(dstip)

If the event has the IP address in the IPv4 format, it seems to parse it fine. However, when it gets a IPv6 most of the fields are blank. But the IPv6 label fields (c6a2Label, c6a3Label) get set correctly. Any thoughts or comments would be helpful. I'm not sure if the cascade effect of setting the IPv4 then IPv6 is messing things up.

[mmanring · Accepted solution]

Turns out it was not the parser at all, but the aggregation that I had set up on the connector. I didn't have all the necessary fields to do the aggregation correctly and so it was aggregating events that shouldn't have been and blanking fields. Tricky, tricky...