Getting Data In

How to find IP address of a host reporting in Splunk?

iKickFish
Explorer

Hello fellow splunkers,

Fairly remedial question but I have a heavy forwarder that has stopped reporting to splunk and need to find the IP of it. I currently run the following search in order to find all hosts reporting within a specific time period but I can only see hosts name and not IP. Is there any way of easily location the IP of a host?

index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) by hostname

0 Karma
1 Solution

FrankVl
Ultra Champion

Just do your stats by sourceIp instead of hostname?

Or do:

index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) latest(sourceIp) by hostname

View solution in original post

FrankVl
Ultra Champion

Just do your stats by sourceIp instead of hostname?

Or do:

index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) latest(sourceIp) by hostname

iKickFish
Explorer

Excellent!

Thanks Frank!

0 Karma

ranjitbrhm1
Communicator

Ping the hostname perhaps on a terminal? It resolves by itself.

0 Karma

iKickFish
Explorer

The forwarder is down currently, I want to find the IP of it from when it was last reporting successfully.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...