https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68134#M17040 <P>It's in the code box in my original answer. You might want to switch browsers or something if you're not seeing it, it's fully visible <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 24 Sep 2012 12:23:37 GMT Ayn 2012-09-24T12:23:37Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68129#M17035 <P>Hi ,</P> <P>I am trying to track who all using splunk and ip address of there system.I found this query<BR /> index=_audit action="login attempt" info="succeeded" | JOIN type=left date_year date_month date_mday date_hour date_minute date_second [ search index=_internal "POST /en-US/account/login HTTP/1.1" | fields date_year date_month date_mday date_hour date_minute date_second clientip] | eval newfield = if(isnull(clientip), 1, 0) | search newfield=0 | table clientip user _time</P> <P>But it is not returning the system ip.It is showing splun base ip.How to convert it to the real system IP address.Is it possible.</P> Mon, 28 Sep 2020 12:29:48 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68129#M17035 john 2020-09-28T12:29:48Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68130#M17036 <P>The events in the <CODE>_audit</CODE> index do not have this information. You could grab it from the <CODE>_internal</CODE> index pretty easily though:</P> <PRE><CODE>index=_internal sourcetype=splunk_web_service action=login status=success | table _time clientip user </CODE></PRE> Mon, 24 Sep 2012 11:44:26 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68130#M17036 Ayn 2012-09-24T11:44:26Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68131#M17037 <P>iam not able to see what you quoted here.My problem is like iam able to get the ip address of my system like</P> <P>user clientip<BR /> admin 127.x.x but my ip adress is 16x.x.x.x</P> <P>and those who have logged in my sever iam getting those ip address as 16x.x.x.x<BR /> but it is not the true system ip.</P> <P>Iam excpecting ouputlike</P> <P>USER SystemIP<BR /> Admin 16x.x.x.x<BR /> user1 16x.x.u.i<BR /> user2 16g.g.g.g</P> Mon, 24 Sep 2012 12:02:32 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68131#M17037 john 2012-09-24T12:02:32Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68132#M17038 <P>What are you not able to see, my search?</P> <P>The IP addresses listed by Splunk at least in the search I wrote is the IP addresses Splunk "sees" - if you have a NAT or proxy that your clients connect to Splunk through, there's no way for Splunk to see what IP address the actual source system has.</P> Mon, 24 Sep 2012 12:05:55 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68132#M17038 Ayn 2012-09-24T12:05:55Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68133#M17039 <P>yes Ayn.can you put that in comment</P> Mon, 24 Sep 2012 12:21:03 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68133#M17039 john 2012-09-24T12:21:03Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68134#M17040 <P>It's in the code box in my original answer. You might want to switch browsers or something if you're not seeing it, it's fully visible <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 24 Sep 2012 12:23:37 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68134#M17040 Ayn 2012-09-24T12:23:37Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68135#M17041 <P>yes it is browser issue.I already found that query.But that client ip which showing is not the real system ip address of host which accessing my server.</P> Mon, 24 Sep 2012 12:29:10 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68135#M17041 john 2012-09-24T12:29:10Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68136#M17042 <P>In that case I refer you to the comment I wrote about proxy/NAT effects.</P> Mon, 24 Sep 2012 12:32:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68136#M17042 Ayn 2012-09-24T12:32:33Z https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68137#M17043 <P>thanks ayn</P> Mon, 24 Sep 2012 12:35:03 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-user-system-ip/m-p/68137#M17043 john 2012-09-24T12:35:03Z