https://community.splunk.com/t5/Getting-Data-In/Under-Web-Analytics-what-does-Top-ClientIPs-quot-quot-mean/m-p/302225#M93528 <P>Under Web Analytics what does Top ClientIPs="-" mean?</P> Thu, 11 Jan 2018 15:29:19 GMT ajay2614 2018-01-11T15:29:19Z https://community.splunk.com/t5/Getting-Data-In/Under-Web-Analytics-what-does-Top-ClientIPs-quot-quot-mean/m-p/302225#M93528 <P>Under Web Analytics what does Top ClientIPs="-" mean?</P> Thu, 11 Jan 2018 15:29:19 GMT https://community.splunk.com/t5/Getting-Data-In/Under-Web-Analytics-what-does-Top-ClientIPs-quot-quot-mean/m-p/302225#M93528 ajay2614 2018-01-11T15:29:19Z https://community.splunk.com/t5/Getting-Data-In/Under-Web-Analytics-what-does-Top-ClientIPs-quot-quot-mean/m-p/302226#M93529 <P>That depends on the source - where did this data come from? If the source is a log file, you should be able to find documentation on the log file.</P> <P>Splunk does not insert any data into the <CODE>ClientIPs</CODE> field, so the <CODE>dash/blank/null</CODE> came from source log file. If it's a custom log file then you should contact developer. If it is a standard log file then look for the documentation.</P> <P>I assume that you are looking at the events from a Splunk search, so it should be easy to identify the <CODE>host, sourcetype and source</CODE> of the events.</P> <P>I hope this solves your query now!</P> Fri, 12 Jan 2018 05:38:19 GMT https://community.splunk.com/t5/Getting-Data-In/Under-Web-Analytics-what-does-Top-ClientIPs-quot-quot-mean/m-p/302226#M93529 mayurr98 2018-01-12T05:38:19Z