topic Issue with having same client ip address in Splunk Enterprise

Issue with having same client ip address

haripriyasarve1 — Wed, 28 Oct 2020 12:27:07 GMT

Hi Everyone,

I need to create a dashboard to know from which location the user is accessing the splunkweb.

The issue is in my splunk _internal webaccess logs , every log has same ipaddress as 127.0.0.1

How to change this configuration and how to know from which location the user is accessing the splunk web.

Thanks in advance.

Re: Issue with having same client ip address

richgalloway — Wed, 28 Oct 2020 13:11:07 GMT

What query are you using to find accesses? Where are you getting the data?

Re: Issue with having same client ip address

isoutamo — Wed, 28 Oct 2020 14:30:45 GMT

You could try this:

index=_internal sourcetype=splunkd_ui_access user=* clientip=* source="*/var/log/splunk/splunkd_ui_access.log" | stats latest_time(_time) as _time values(clientip) by user

r. Ismo

Re: Issue with having same client ip address

haripriyasarve1 — Thu, 29 Oct 2020 00:50:29 GMT

I am using the below query to see get the list of users and their ipaddress for the app they are using.

index=_internal source=*web_access.log* "*appname*"
|table clientip user

Re: Issue with having same client ip address

isoutamo — Thu, 29 Oct 2020 07:18:47 GMT

This probably will give always to 127.0.0.1 to you. So better to use sourcetype=splunkd_ui_access user=* clientip=* source="*/var/log/splunk/splunkd_ui_access.log" to get those IP's which are used to connect to splunk web ui. BUT if you are using LB in front of you SHC, then this is probably that address, not the real user's ip.

Re: Issue with having same client ip address

haripriyasarve1 — Sun, 01 Nov 2020 02:28:42 GMT

Thank you