https://community.splunk.com/t5/Security/source-IP-field/m-p/474369#M15229 <P>Unless you explicitly override the "host" field, it'll be part of the metadata field "host"</P> Fri, 01 Nov 2019 17:01:10 GMT arjunpkishore5 2019-11-01T17:01:10Z https://community.splunk.com/t5/Security/source-IP-field/m-p/474368#M15228 <P>Hello,</P> <P>I am new to splunk and have not started the evaluation yet but wanted to ask this question that may be obvious.</P> <P>Let's say Firewall-1 sends logs to splunk with the source IP defined as "src IP"<BR /> Firewall-2 sends logs to splunk with source IP defined as "source IP"</P> <P>Would splunk automatically place it into a common filed? If so, what would that field be called? If splunk can't place it into a common field what would an admin have to do to accomplish that?</P> Fri, 01 Nov 2019 16:55:18 GMT https://community.splunk.com/t5/Security/source-IP-field/m-p/474368#M15228 allenhau 2019-11-01T16:55:18Z https://community.splunk.com/t5/Security/source-IP-field/m-p/474369#M15229 <P>Unless you explicitly override the "host" field, it'll be part of the metadata field "host"</P> Fri, 01 Nov 2019 17:01:10 GMT https://community.splunk.com/t5/Security/source-IP-field/m-p/474369#M15229 arjunpkishore5 2019-11-01T17:01:10Z