How can one get the host and source IP addresses in the event logs instead of hostname ?

[sahil_singh]

Hi,

How can one get the host and source IP addresses in the event logs instead of hostname in either places. It is causing an issue regarding the analysis of the logs. Additionally is there an option for alert email generation, when the alert is high.

[Ayn]

You can do this by using an external lookup script that gets the corresponding IP address from the DNS entry. There's a script that's included with Splunk as an example that does just this. More information is available here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources

[sahil_singh]

hello can somebody help me here ?

[sahil_singh]

yes...I downlaoded and ran universal forwarder onto two CPUs and am collecting logs from there. This is what it is showing as a result. If I search for telnet events of one CPU.

[Ayn]

How are you receiving these logs? From Universal Forwarders?

[sahil_singh]

The telnet session will occur between two CPU. So isn't there an option of having IPs of both machines rather than have the name. Since identification process would far more easier and less time consuming.

[sahil_singh]

for eg. There is a telnet session which takes place between two PCs in the network. Rather than having a hostname=CPU-WS2 representing that session. Is there an possibility that an IP could there instead ?

LogName=Security
SourceName=Security
EventCode=593
EventType=8
Type=Success Audit
ComputerName=CPU-WS2
User=CPU

Message=A process has exited:
Process ID:4732
Image File Name:C:\WINDOWS\system32\telnet.exe
User Name:CPU
Domain: CPU-WS2
Logon ID:(0x0,0xDD17)

host=CPU-ws2

Options|sourcetype=WinEventLog:Security

Options|source=WinEventLog:Security

Options|index=main Options

[MarioM]

what you are trying is not very clear then could you paste the extract of your event and more detailed explanation