Reporting

Dynamically insert IP address into saved search

John_Mark
Splunk Employee
Splunk Employee

I have a team of web developers using Splunk to debug their web apps. When they're debugging apps, they're all hitting the same web server. What I'd like to do is be able to utilize saved searches that automatically filter results only for their IP address (or some other unique identifier). I found some tips on dynamic saved searches from this Question: http://answers.splunk.com/questions/5571/way-to-insert-create-field-based-on-source

But I'm still not sure how I would tell Splunk my machine's IP address, and how it could be inserted into a saved search.

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

First, you haven't been concrete in saying which IP you're referring to. If it's the IP of the web browser, and splunkd is on a separate machine, then you're pretty much out of luck. If you care about the IP of the machine that splunkd is on, then you might consider setting up a macro that gets the IP of that machine. If you called the macro myIP, you could refer to it in your search when wrapped with backticks. If your splunkd is shared, then you could have one of these per user in /etc/users/<username>/search/local/macros.conf.

View solution in original post

John_Mark
Splunk Employee
Splunk Employee

ah, well. It had some recommendations on how to insert dynamic fields into a search, so I thought it might apply.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

It's unclear to me how the linked question has anything to do with this question.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

First, you haven't been concrete in saying which IP you're referring to. If it's the IP of the web browser, and splunkd is on a separate machine, then you're pretty much out of luck. If you care about the IP of the machine that splunkd is on, then you might consider setting up a macro that gets the IP of that machine. If you called the macro myIP, you could refer to it in your search when wrapped with backticks. If your splunkd is shared, then you could have one of these per user in /etc/users/<username>/search/local/macros.conf.

John_Mark
Splunk Employee
Splunk Employee

Aha! sorry. head-slapper there 🙂 thanks!

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Define developer's IP. If you have a mapping of splunk user to IP, then the macro trick is best.

0 Karma

John_Mark
Splunk Employee
Splunk Employee

It depends - of primary interest is the ability of the developer to filter for only their debugging results, but if we know that it's impossible to grab the developer's IP, then we can jump through some hoops to do our testing via the splunkd machine. We could also have splunkd running on each developer box. We had hoped to avoid that, but given the small amount of data to index, this probably wouldn't be a huge resource hog.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...