https://community.splunk.com/t5/Getting-Data-In/Src-IP-is-showing-up-as-dash-hyphen/m-p/466209#M80322 <P>It's not a Splunk problem. <CODE>-</CODE> is what Windows provided for an IP address in the event.</P> Thu, 02 Apr 2020 20:31:48 GMT richgalloway 2020-04-02T20:31:48Z https://community.splunk.com/t5/Getting-Data-In/Src-IP-is-showing-up-as-dash-hyphen/m-p/466208#M80321 <P>I'm trying to troubleshoot an repeated authentication failure by specific users(s). When I try to filter the search with (user account status=failure) I see all failure events with the details below. </P> <P>host - domain controllers (AD servers) of that region where user is in<BR /> source - WinEventLog:Security<BR /> sourcetype - WinEventLog:Security</P> <P>Only concern is, i don't see the src_ip field showing any IP address. It just has a dash (hyphen)</P> <P>The other fields are fine as listed below. <BR /> src - domain controllers<BR /> src_ip - dash (hypen)<BR /> src_user - account name of the user in the AD</P> <P>Can someone help why the src_ip isn't populating ? Is that because Splunk couldn't determine it ? or any config tweaks has to be done ?</P> <P>Please help !</P> Wed, 30 Sep 2020 04:51:56 GMT https://community.splunk.com/t5/Getting-Data-In/Src-IP-is-showing-up-as-dash-hyphen/m-p/466208#M80321 rmura1 2020-09-30T04:51:56Z https://community.splunk.com/t5/Getting-Data-In/Src-IP-is-showing-up-as-dash-hyphen/m-p/466209#M80322 <P>It's not a Splunk problem. <CODE>-</CODE> is what Windows provided for an IP address in the event.</P> Thu, 02 Apr 2020 20:31:48 GMT https://community.splunk.com/t5/Getting-Data-In/Src-IP-is-showing-up-as-dash-hyphen/m-p/466209#M80322 richgalloway 2020-04-02T20:31:48Z