Dynamically insert IP address into saved search

[John_Mark]

I have a team of web developers using Splunk to debug their web apps. When they're debugging apps, they're all hitting the same web server. What I'd like to do is be able to utilize saved searches that automatically filter results only for their IP address (or some other unique identifier). I found some tips on dynamic saved searches from this Question: http://answers.splunk.com/questions/5571/way-to-insert-create-field-based-on-source

But I'm still not sure how I would tell Splunk my machine's IP address, and how it could be inserted into a saved search.

[John_Mark]

ah, well. It had some recommendations on how to insert dynamic fields into a search, so I thought it might apply.

[Stephen_Sorkin]

It's unclear to me how the linked question has anything to do with this question.

[Stephen_Sorkin · Accepted solution]

First, you haven't been concrete in saying which IP you're referring to. If it's the IP of the web browser, and splunkd is on a separate machine, then you're pretty much out of luck. If you care about the IP of the machine that splunkd is on, then you might consider setting up a macro that gets the IP of that machine. If you called the macro myIP, you could refer to it in your search when wrapped with backticks. If your splunkd is shared, then you could have one of these per user in /etc/users/<username>/search/local/macros.conf.

[John_Mark]

Aha! sorry. head-slapper there 🙂 thanks!

[Stephen_Sorkin]

Define developer's IP. If you have a mapping of splunk user to IP, then the macro trick is best.

[John_Mark]

It depends - of primary interest is the ability of the developer to filter for only their debugging results, but if we know that it's impossible to grab the developer's IP, then we can jump through some hoops to do our testing via the splunkd machine. We could also have splunkd running on each developer box. We had hoped to avoid that, but given the small amount of data to index, this probably wouldn't be a huge resource hog.