Deployment Architecture

All systems showing same IP Addresses in Forwarder Management

DEADBEEF
Path Finder

My deployment server sits behind a load balancer.  What I have noticed is that on the DS under Forwarder Management (Clients tab), all my UFs phoning home now appear with the same IP address (they have unique client names, host name, instance name).

Is there a macro or something on the back end that I can update to display the true IP address of each system phoning home?  The true source IP is showing in in metrics.log so I'd like to modify the existing SPL to use the IP from metrics rather than wherever it's getting it from.

Labels (2)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!