Knowledge Management

Determine Source IP of log entry

jwilson_clover
Engager

I have log entries that are appearing in Splunk that are being labeled as coming from a specific host, but that host isn't even turned on.

How can I view the origin IP of a log entry regardless of the host label?

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

This is not possible. The only metadata associated to any particular event (by default) is: host, sourcetype, source, and index. You could create a new indexed field extraction to identify the origin IP, or apply a transformation to the host field, but you have to configure it, and it will only be applied to future events.

You might also consider setting the host field to the desired value(s) in inputs.conf for each input stanza on your forwarder(s).

See:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Overridedefaulthostassignments

View solution in original post

masonmorales
Influencer

This is not possible. The only metadata associated to any particular event (by default) is: host, sourcetype, source, and index. You could create a new indexed field extraction to identify the origin IP, or apply a transformation to the host field, but you have to configure it, and it will only be applied to future events.

You might also consider setting the host field to the desired value(s) in inputs.conf for each input stanza on your forwarder(s).

See:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Overridedefaulthostassignments

jwilson_clover
Engager

All the hosts have that set, yet this mysterious entry keeps appearing.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...