topic Re: IP address of current user? in Splunk Search

IP address of current user?

matstap — Fri, 23 Feb 2018 21:10:14 GMT

I'm trying to write a query to display the IP address of the current user. Anyone know how to do this?

Re: IP address of current user?

somesoni2 — Fri, 23 Feb 2018 21:18:27 GMT

Current user using Splunk Web UI (trying to display from user logged in from)?

Re: IP address of current user?

skoelpin — Fri, 23 Feb 2018 21:37:00 GMT

We're going to need more information than that..

Are your events logging in Splunk? Did you have a field that captures the IP addresses? Do you have a field or lookup table of users? You want the current users IP address who's logged into Splunk? And lastly, ofcourse we know how to do this.. You provide the correct information and we provide the correct solution 🙂

Re: IP address of current user?

elliotproebstel — Fri, 23 Feb 2018 22:37:43 GMT

Depending on your infrastructure, the following may work:

index=_internal sourcetype=splunkd_ui_access 
    [| rest /services/authentication/current-context splunk_server=local 
    | stats values(username) AS search 
    | format ] 
| head 1 
| stats list(clientip) AS clientip

The subsearch will return the username of the user who is currently logged in. It uses that to search across splunkd_ui_access logs and extracts the clientip from the latest matching one.

However, this doesn't work at all on my system, because we have a proxy on our Splunk server, which means this returns 127.0.0.1 for every user. 🙂 So your mileage may vary.