Issue with having same client ip address

[haripriyasarve1]

Hi Everyone,

I need to create a dashboard to know from which location the user is accessing the splunkweb. 

The issue is in my splunk _internal webaccess logs , every log has same ipaddress as 127.0.0.1

How to change this configuration and how to know from which location the user is accessing the splunk web.

Thanks in advance. 

[isoutamo · Accepted solution]

Hi

You could try this:

index=_internal sourcetype=splunkd_ui_access user=* clientip=* source="*/var/log/splunk/splunkd_ui_access.log" 
| stats latest_time(_time) as _time values(clientip) by user

r. Ismo 

[haripriyasarve1]

Thank you 

[richgalloway]

What query are you using to find accesses?  Where are you getting the data?

[haripriyasarve1]

I am using the below query to see get the list of users and their ipaddress for the app they are using.

index=_internal source=*web_access.log* "*appname*"
|table clientip user

[isoutamo]

This probably will give always to 127.0.0.1 to you. So better to use sourcetype=splunkd_ui_access user=* clientip=* source="*/var/log/splunk/splunkd_ui_access.log" to get those IP's which are used to connect to splunk web ui. BUT if you are using LB in front of you SHC, then this is probably that address, not the real user's ip.