Splunk Search

Why do all clients in splunk_web_access logs have the same IP?

hartfoml
Motivator

When I run this search:

index=_internal  clientip=*  host="My-SearchHead" sourcetype=splunk_web_access | dedup user | table user clientip host

I get this result:

user      clientip   host
MyUser  127.0.0.1   My-SaerchHead 

All the users have the same IP.

Anyone know why this is and how I can change it?

0 Karma

woodcock
Esteemed Legend

There is probably nothing that you can (or at least you nothing that you should) do about it; it is an indication that Splunk is using loopback to process the user session on the search head. What you can do is get rid if the host=My-SearchHead part and you may see other hosts (if you are using Search Head Pooling, etc.). You can also use dnslookup to translate the host (name) to IP address like this:

index=_internal clientip=* sourcetype=splunk_web_access | table user clientip host | dnslookup forward host ip

If you are trying to see what IP addresses are connecting to your search head, you will have to use another method.

0 Karma

hartfoml
Motivator

thanks Much @woodcock for the response. this is an adaptation of a search in the "SplunkApp:Utilization Monitor for Splunk" All users from all splunk systems that are running the web interface are showing the loopback address. Do you. Using the dnslookup i don't think will yearly anything since it is showing the loopback IP.

0 Karma

woodcock
Esteemed Legend

You misunderstand; the dnslookup is on the host, which is your Search Head name, of which there may be many if you are in a cluster or pool, and will return the IP address for each one, not for the loopback IP.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...