Getting Data In

Getting IP address of Splunk server instead of particular PC in logs.

ginstinct
New Member

I am forwarding logs from several windows PCs to Splunk with Heavy forwarders. And the Splunk is forwarding those logs to the third party SIEM which is Alienvault. Logs are coming fine but in logs, hostnames are different from different windows PC but the IP address is common. I think the IP address is of Splunk server which is coming in each log. I need to know the way to get the respective IP address of windows machines in logs. so that I can identify the logs from a particular PC. Thanks in advance.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...