Reporting

Dynamically insert IP address into saved search

John_Mark
Splunk Employee
Splunk Employee

I have a team of web developers using Splunk to debug their web apps. When they're debugging apps, they're all hitting the same web server. What I'd like to do is be able to utilize saved searches that automatically filter results only for their IP address (or some other unique identifier). I found some tips on dynamic saved searches from this Question: http://answers.splunk.com/questions/5571/way-to-insert-create-field-based-on-source

But I'm still not sure how I would tell Splunk my machine's IP address, and how it could be inserted into a saved search.

1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

First, you haven't been concrete in saying which IP you're referring to. If it's the IP of the web browser, and splunkd is on a separate machine, then you're pretty much out of luck. If you care about the IP of the machine that splunkd is on, then you might consider setting up a macro that gets the IP of that machine. If you called the macro myIP, you could refer to it in your search when wrapped with backticks. If your splunkd is shared, then you could have one of these per user in /etc/users/<username>/search/local/macros.conf.

View solution in original post

John_Mark
Splunk Employee
Splunk Employee

ah, well. It had some recommendations on how to insert dynamic fields into a search, so I thought it might apply.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

It's unclear to me how the linked question has anything to do with this question.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

First, you haven't been concrete in saying which IP you're referring to. If it's the IP of the web browser, and splunkd is on a separate machine, then you're pretty much out of luck. If you care about the IP of the machine that splunkd is on, then you might consider setting up a macro that gets the IP of that machine. If you called the macro myIP, you could refer to it in your search when wrapped with backticks. If your splunkd is shared, then you could have one of these per user in /etc/users/<username>/search/local/macros.conf.

John_Mark
Splunk Employee
Splunk Employee

Aha! sorry. head-slapper there 🙂 thanks!

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Define developer's IP. If you have a mapping of splunk user to IP, then the macro trick is best.

0 Karma

John_Mark
Splunk Employee
Splunk Employee

It depends - of primary interest is the ability of the developer to filter for only their debugging results, but if we know that it's impossible to grab the developer's IP, then we can jump through some hoops to do our testing via the splunkd machine. We could also have splunkd running on each developer box. We had hoped to avoid that, but given the small amount of data to index, this probably wouldn't be a huge resource hog.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...