I have the IP address but need to search for what user is logged into that device. How would I go about doing that?

[TXITGUYII]

Brand new to Splunk...... I have about enough experience with it to spell it. I have been tasked with a set of IP addresses and to find out what users are logged into those devices so that we can contact them and discuss why their machines are causing the issue.

Any help will be much appreciated.

[martin_mueller · Accepted solution]

Your first step would be to find out what data you have, or more specifically where in your data you can find references to the IP. The easiest approach would be to search something like index=* 1.2.3.4 for whatever IP you have... start with a small time range, depending on how much data you have this might take a bit.

What data do you have?

[TXITGUYII]

The username is included in the data! Thank you so much form your help. I cant tell you how much I appreciate it.