Getting Data In

How to find IP address of a host reporting in Splunk?

iKickFish
Explorer

Hello fellow splunkers,

Fairly remedial question but I have a heavy forwarder that has stopped reporting to splunk and need to find the IP of it. I currently run the following search in order to find all hosts reporting within a specific time period but I can only see hosts name and not IP. Is there any way of easily location the IP of a host?

index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) by hostname

0 Karma
1 Solution

FrankVl
Ultra Champion

Just do your stats by sourceIp instead of hostname?

Or do:

index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) latest(sourceIp) by hostname

View solution in original post

FrankVl
Ultra Champion

Just do your stats by sourceIp instead of hostname?

Or do:

index=_internal sourcetype=splunkd group=tcpin_connections | stats first(version) latest(sourceIp) by hostname

iKickFish
Explorer

Excellent!

Thanks Frank!

0 Karma

ranjitbrhm1
Communicator

Ping the hostname perhaps on a terminal? It resolves by itself.

0 Karma

iKickFish
Explorer

The forwarder is down currently, I want to find the IP of it from when it was last reporting successfully.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...