Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Re: Determine Source IP of log entry
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have log entries that are appearing in Splunk that are being labeled as coming from a specific host, but that host isn't even turned on.
How can I view the origin IP of a log entry regardless of the host label?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is not possible. The only metadata associated to any particular event (by default) is: host, sourcetype, source, and index. You could create a new indexed field extraction to identify the origin IP, or apply a transformation to the host field, but you have to configure it, and it will only be applied to future events.
You might also consider setting the host field to the desired value(s) in inputs.conf for each input stanza on your forwarder(s).
See:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Overridedefaulthostassignments
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is not possible. The only metadata associated to any particular event (by default) is: host, sourcetype, source, and index. You could create a new indexed field extraction to identify the origin IP, or apply a transformation to the host field, but you have to configure it, and it will only be applied to future events.
You might also consider setting the host field to the desired value(s) in inputs.conf for each input stanza on your forwarder(s).
See:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Overridedefaulthostassignments
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All the hosts have that set, yet this mysterious entry keeps appearing.
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
