https://community.splunk.com/t5/Splunk-Dev/Splunk-Web-Access-Log/m-p/692778#M11582 <P>Hi,&nbsp;If you make a curl request to the Splunk, that in the web_access.log the client is a 127.0.0.1 and user is '-', can we somehow correct client field to know who actually made the request?</P> Tue, 09 Jul 2024 16:03:58 GMT user487596 2024-07-09T16:03:58Z https://community.splunk.com/t5/Splunk-Dev/Splunk-Web-Access-Log/m-p/692778#M11582 <P>Hi,&nbsp;If you make a curl request to the Splunk, that in the web_access.log the client is a 127.0.0.1 and user is '-', can we somehow correct client field to know who actually made the request?</P> Tue, 09 Jul 2024 16:03:58 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-Web-Access-Log/m-p/692778#M11582 user487596 2024-07-09T16:03:58Z https://community.splunk.com/t5/Splunk-Dev/Splunk-Web-Access-Log/m-p/692877#M11584 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/268899">@user487596</a>- I have same result for client info, it feels like this is how it designs. But I feel having actual IP would help.</P><P>For username, in some events I do see actual username in my case. In some events it is "-".</P> Wed, 10 Jul 2024 13:04:08 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-Web-Access-Log/m-p/692877#M11584 VatsalJagani 2024-07-10T13:04:08Z