All Apps and Add-ons

clientip-internal

lauMarot
Path Finder

Shouldn't clientip-internal be configured ?

default value is : eventtype=web-traffic clientip=Some.CIDR.Range

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee

Hi lauMArot

This is optional. If you configure this there will be an eventtype called clientip-internal that you can use for searching. No dashboards are currently using this but might do in the future.

j

0 Karma

lauMarot
Path Finder

alt text

0 Karma

lauMarot
Path Finder

"No dashboards are currently using this but might do in the future. "

are you sure ???

as event type clientip-internal appears in pageview = (eventtype=web-traffic
status=200
NOT (eventtype=web-uri-nonpage OR
eventtype=web-agent-nonpublic OR
eventtype=exclude-pageview)

and

web-agent-nonpublic is defined as follow : eventtype=ua-bot OR eventtype=clientip-nonroutable OR eventtype=clientip-internal

so clientip-internal is indeed used for example in Traffic Center (but the filter as -not- defined does not applied to any event)

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...