Splunk Enterprise Security

Splunk for Enterprise Security: How to enter two IP addresses for our webserver to show in Asset Investigator?

MaverickT
Communicator

Hi, i am trying to solve issue I encountered with enterprise security. Our company has webserver that is accessible from internal network and from internet. It uses two IP addresses (internal and external). I haven't find the way how to enter both IP addresses for this asset to show them in Asset Investigator. If I enter it pipe separated or dot separated it doesn't help. I have tried with duplicating this asset with different IP address, but it doesn't do the trick as well. Is there any other workaround for this issue?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, multi-homed hosts like that require a different technique: http://docs.splunk.com/Documentation/ES/3.1.1/Install/IdentityManager#Define_multi-homed_hosts

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...