Splunk Search

Can I return the host IP address in WinEventLog metadata search?

lball
Explorer

I'm trying to use a metadata search to quickly return the hosts that are currently sending logs to Splunk to determine if we are missing any logs. Here is the current search:

| metadata type=hosts index=wineventlog | table host

Is there a way to also return the IP address of the host from the metadata search?

0 Karma

Vijeta
Influencer

Use this-

| metadata type=hosts index=wineventlog | table host| lookup dnslookup clienthost AS host

Also this documentation will be helpful
http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Addfieldsfromexternaldatasources#Externa...

0 Karma

lball
Explorer

I tried this search string, but I got an empty clientip field added to the table...not exactly why it's not returning the IP values. No error is shown...

0 Karma

dyeo
Engager

same for me... the clientip field is empty

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...