https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390241#M69842 <P>The forwarder is down currently, I want to find the IP of it from when it was last reporting successfully.</P> Mon, 14 May 2018 13:25:33 GMT iKickFish 2018-05-14T13:25:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390239#M69840 <P>Hello fellow splunkers,</P> <P>Fairly remedial question but I have a heavy forwarder that has stopped reporting to splunk and need to find the IP of it. I currently run the following search in order to find all hosts reporting within a specific time period but I can only see hosts name and not IP. Is there any way of easily location the IP of a host?</P> <P>index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) by hostname</P> Tue, 29 Sep 2020 19:28:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390239#M69840 iKickFish 2020-09-29T19:28:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390240#M69841 <P>Ping the hostname perhaps on a terminal? It resolves by itself.</P> Mon, 14 May 2018 13:20:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390240#M69841 ranjitbrhm1 2018-05-14T13:20:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390241#M69842 <P>The forwarder is down currently, I want to find the IP of it from when it was last reporting successfully.</P> Mon, 14 May 2018 13:25:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390241#M69842 iKickFish 2018-05-14T13:25:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390242#M69843 <P>Just do your stats by sourceIp instead of hostname?</P> <P>Or do:</P> <PRE><CODE>index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) latest(sourceIp) by hostname </CODE></PRE> Mon, 14 May 2018 13:45:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390242#M69843 FrankVl 2018-05-14T13:45:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390243#M69844 <P>Excellent!</P> <P>Thanks Frank!</P> Tue, 15 May 2018 14:35:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-IP-address-of-a-host-reporting-in-Splunk/m-p/390243#M69844 iKickFish 2018-05-15T14:35:13Z