topic Re: Dynamically insert IP address into saved search in Reporting

Dynamically insert IP address into saved search

John_Mark — Thu, 19 Aug 2010 05:13:10 GMT

I have a team of web developers using Splunk to debug their web apps. When they're debugging apps, they're all hitting the same web server. What I'd like to do is be able to utilize saved searches that automatically filter results only for their IP address (or some other unique identifier). I found some tips on dynamic saved searches from this Question: http://answers.splunk.com/questions/5571/way-to-insert-create-field-based-on-source

But I'm still not sure how I would tell Splunk my machine's IP address, and how it could be inserted into a saved search.

Re: Dynamically insert IP address into saved search

Stephen_Sorkin — Thu, 19 Aug 2010 09:59:14 GMT

First, you haven't been concrete in saying which IP you're referring to. If it's the IP of the web browser, and splunkd is on a separate machine, then you're pretty much out of luck. If you care about the IP of the machine that splunkd is on, then you might consider setting up a macro that gets the IP of that machine. If you called the macro myIP, you could refer to it in your search when wrapped with backticks. If your splunkd is shared, then you could have one of these per user in /etc/users/<username>/search/local/macros.conf.

Re: Dynamically insert IP address into saved search

Stephen_Sorkin — Thu, 19 Aug 2010 11:18:35 GMT

It's unclear to me how the linked question has anything to do with this question.

Re: Dynamically insert IP address into saved search

John_Mark — Fri, 20 Aug 2010 01:18:43 GMT

It depends - of primary interest is the ability of the developer to filter for only their debugging results, but if we know that it's impossible to grab the developer's IP, then we can jump through some hoops to do our testing via the splunkd machine. We could also have splunkd running on each developer box. We had hoped to avoid that, but given the small amount of data to index, this probably wouldn't be a huge resource hog.

Re: Dynamically insert IP address into saved search

John_Mark — Fri, 20 Aug 2010 01:19:46 GMT

ah, well. It had some recommendations on how to insert dynamic fields into a search, so I thought it might apply.

Re: Dynamically insert IP address into saved search

Stephen_Sorkin — Fri, 20 Aug 2010 01:22:07 GMT

Define developer's IP. If you have a mapping of splunk user to IP, then the macro trick is best.

Re: Dynamically insert IP address into saved search

John_Mark — Sat, 21 Aug 2010 01:13:06 GMT

Aha! sorry. head-slapper there 🙂 thanks!