https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203771#M59187 <P>You would have to use some DNSlookup type of things to get IP address from host name. And you can use clientip, src_ip, dns_ip, server_ip..Etc according to your Splunk naming conversion you have to use the search strings. See the props.conf file for host and ip </P> <P>Try to use this query,</P> <PRE><CODE>index=_audit action="login attempt" info="succeeded"| head 20 | iplocation clientip | table clientip, user, _time </CODE></PRE> Tue, 29 Sep 2020 10:27:47 GMT hliakathali_spl 2020-09-29T10:27:47Z https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203770#M59186 <P>I have a search to alert on account lockouts:</P> <PRE><CODE>index=winsec EventCodeDescription="A user account was locked out"|dedup user| stats count as total by _time host user </CODE></PRE> <P>I need to get the "IP" as well when the account is locked out. Could you please help me on getting the IP address of the system along with this event alert search?</P> <P>Regards,<BR /> Gayathiri K</P> Wed, 03 Aug 2016 08:16:30 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203770#M59186 Gayathirik 2016-08-03T08:16:30Z https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203771#M59187 <P>You would have to use some DNSlookup type of things to get IP address from host name. And you can use clientip, src_ip, dns_ip, server_ip..Etc according to your Splunk naming conversion you have to use the search strings. See the props.conf file for host and ip </P> <P>Try to use this query,</P> <PRE><CODE>index=_audit action="login attempt" info="succeeded"| head 20 | iplocation clientip | table clientip, user, _time </CODE></PRE> Tue, 29 Sep 2020 10:27:47 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203771#M59187 hliakathali_spl 2020-09-29T10:27:47Z https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203772#M59188 <P>Try this</P> <PRE><CODE>index=winsec EventCodeDescription="A user account was locked out"| stats count as total by _time host user Source_Network_Address </CODE></PRE> Wed, 03 Aug 2016 19:48:26 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203772#M59188 sundareshr 2016-08-03T19:48:26Z https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203773#M59189 <P>This is not working..Could you please tell me some other possible way to find it out?</P> Thu, 04 Aug 2016 08:49:27 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203773#M59189 Gayathirik 2016-08-04T08:49:27Z https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203774#M59190 <P>Excellent Harish!!! This really works!!!!</P> Thu, 04 Aug 2016 13:36:04 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-use-iplocation-to-include-the-IP-in-my-alert-search/m-p/203774#M59190 Gayathirik 2016-08-04T13:36:04Z