Splunk Search

Is it possible to create a view showing all events coming from an IP and/user name?

New Member

I'd like to create a dashboard where I could easily search for events coming from a specific IP address or username.

For example:

It would show where that specific IP address was logged on to, URL it accessed, if it was locked out and all that stuff considering all security appliance was added on SPLUNK such as IPS, Web Gateway, Endpoint Protection, active directory and the like.

Just like how should an SIEM should work.

Tags (1)
0 Karma


Assuming you integrated with your IPS etc using CIM compliant TAs, then you can install the Splunk CIM and use the Intrusion Detection or the Network Traffic data models.


0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...