IP address of current user?

[matstap]

I'm trying to write a query to display the IP address of the current user. Anyone know how to do this?

[elliotproebstel · Accepted solution]

Depending on your infrastructure, the following may work:

index=_internal sourcetype=splunkd_ui_access 
    [| rest /services/authentication/current-context splunk_server=local 
    | stats values(username) AS search 
    | format ] 
| head 1 
| stats list(clientip) AS clientip

The subsearch will return the username of the user who is currently logged in. It uses that to search across splunkd_ui_access logs and extracts the clientip from the latest matching one.

However, this doesn't work at all on my system, because we have a proxy on our Splunk server, which means this returns 127.0.0.1 for every user. 🙂 So your mileage may vary.

[skoelpin]

We're going to need more information than that..

Are your events logging in Splunk? Did you have a field that captures the IP addresses? Do you have a field or lookup table of users? You want the current users IP address who's logged into Splunk? And lastly, ofcourse we know how to do this.. You provide the correct information and we provide the correct solution 🙂

[somesoni2]

Current user using Splunk Web UI (trying to display from user logged in from)?