Splunk Enterprise Security

Splunk for Enterprise Security: How to enter two IP addresses for our webserver to show in Asset Investigator?

MaverickT
Communicator

Hi, i am trying to solve issue I encountered with enterprise security. Our company has webserver that is accessible from internal network and from internet. It uses two IP addresses (internal and external). I haven't find the way how to enter both IP addresses for this asset to show them in Asset Investigator. If I enter it pipe separated or dot separated it doesn't help. I have tried with duplicating this asset with different IP address, but it doesn't do the trick as well. Is there any other workaround for this issue?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, multi-homed hosts like that require a different technique: http://docs.splunk.com/Documentation/ES/3.1.1/Install/IdentityManager#Define_multi-homed_hosts

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...