https://community.splunk.com/t5/Security/proxy-log-name-resolution/m-p/106506#M3405 <P>what kind of IP? Public?internal? internal from dhcp?<BR /> Here an example of dns lookup <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsfromexternaldatasources#Example_of_external_fields_lookup">dns lookup external script</A></P> Tue, 24 Jul 2012 15:50:55 GMT MarioM 2012-07-24T15:50:55Z https://community.splunk.com/t5/Security/proxy-log-name-resolution/m-p/106505#M3404 <P>In the context of proxy logs - could Splunk (via APIs or what not) enable the resolution of IP addresses to the logged in username for a particular log from a proxy?</P> Tue, 24 Jul 2012 06:31:11 GMT https://community.splunk.com/t5/Security/proxy-log-name-resolution/m-p/106505#M3404 jonathanfalconi 2012-07-24T06:31:11Z https://community.splunk.com/t5/Security/proxy-log-name-resolution/m-p/106506#M3405 <P>what kind of IP? Public?internal? internal from dhcp?<BR /> Here an example of dns lookup <A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsfromexternaldatasources#Example_of_external_fields_lookup">dns lookup external script</A></P> Tue, 24 Jul 2012 15:50:55 GMT https://community.splunk.com/t5/Security/proxy-log-name-resolution/m-p/106506#M3405 MarioM 2012-07-24T15:50:55Z https://community.splunk.com/t5/Security/proxy-log-name-resolution/m-p/106507#M3406 <P>Assuming the information is actually <STRONG>available</STRONG>, sure. But you need to drop a little more detail on us. The assumption would have to be that there is something that can tie the IP address in the proxy server logs to a logged-in user at the machine that is assigned the IP in the proxy logs themselves. </P> <P>The clearest solution is to have the proxy require authentication. If you can't do that, then you need to be able to know who is logged into a given machine at a given time. With a multi-user system, like a Windows Terminal Server or any Unix machine this is far more difficult.</P> <P>I think you need to figure out what data you have available to you before you can begin to try to piece together a solution.</P> Tue, 24 Jul 2012 15:58:48 GMT https://community.splunk.com/t5/Security/proxy-log-name-resolution/m-p/106507#M3406 dwaddle 2012-07-24T15:58:48Z