https://community.splunk.com/t5/Splunk-Search/Source-or-destination-IP-Address/m-p/513476#M144073 Could be either. Could be neither. It could be the IP address of the device that generated the event. We don't have enough information. Tue, 11 Aug 2020 00:38:48 GMT richgalloway 2020-08-11T00:38:48Z https://community.splunk.com/t5/Splunk-Search/Source-or-destination-IP-Address/m-p/513431#M144053 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk_qns7_p1.PNG" style="width: 489px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/10182i5EA7A13D9EA975B8/image-dimensions/489x22?v=v2" width="489" height="22" role="button" title="splunk_qns7_p1.PNG" alt="splunk_qns7_p1.PNG" /></span></P><P>Is 192.168.1.111 the source or destination IP Address?</P> Mon, 10 Aug 2020 20:28:08 GMT https://community.splunk.com/t5/Splunk-Search/Source-or-destination-IP-Address/m-p/513431#M144053 rkris 2020-08-10T20:28:08Z https://community.splunk.com/t5/Splunk-Search/Source-or-destination-IP-Address/m-p/513476#M144073 Could be either. Could be neither. It could be the IP address of the device that generated the event. We don't have enough information. Tue, 11 Aug 2020 00:38:48 GMT https://community.splunk.com/t5/Splunk-Search/Source-or-destination-IP-Address/m-p/513476#M144073 richgalloway 2020-08-11T00:38:48Z