How to locate Splunk IP?

[w0lverineNOP]

I am configuring my router to a remote Log server(Splunk) but I need the IP address of Splunk on my home computer. I have read and scoured Splunk.com and Google and I am sure I am missing something but can anyone help me find the missing link?

Update: I am assuming Splunks ip is localhost (127.0.0.1)? I am trying to set up Home Monitor but I am having connection trouble. I have an asus N66U if that helps.

[amiracle · Accepted solution]

If you're running Splunk on a Linux or OS X instance, you'll need to run ifconfig and you'll see all the interfaces with their corresponding IP addresses. Typical home networks use a nat'd IP, so something like 192.168.1.x, where x is the unique number associated with your Splunk server.

With either Windows, Linux, or OS X, the IP address of your Splunk server is what you need as the remote syslog server entry. This tells your router to send the syslog data it's collecting to the Splunk server over UDP 514 (default syslog traffic).

[arama]

How can you find the IP that is associated with your Splunk Server? I am running it with local host too and i have a windows machine.

[chanfoli]

So, if your home computer is behind this router, it will most likely be assigned an internal IP address via DHCP when it attaches to the home network. You can find this ip on a windows system with ipconfig /all on the command line. Other operating systems have different tools. Most home routers I have worked with use DHCP pools in the 192.168.x.x range.

The thing about DHCP is that unless you configure the router to make a static IP assignment, this IP could change the next time you connect or when the DHCP lease runs out. So you should also look into static assignments at your router. I hope I understood your question correctly and that this information is helpful.

[zahiratayee]

Hello, My local Splunk IP address is 127.0.0.1:514.

I enabled remote logging  on my endpoint and entered the above address to my endpoint (sys log ) logging remote log server address/ but I'm not receiving the logs from endpoint to the Splunk, any advice? please.

Thanks