Splunk Search

Why do all clients in splunk_web_access logs have the same IP?

hartfoml
Motivator

When I run this search:

index=_internal  clientip=*  host="My-SearchHead" sourcetype=splunk_web_access | dedup user | table user clientip host

I get this result:

user      clientip   host
MyUser  127.0.0.1   My-SaerchHead 

All the users have the same IP.

Anyone know why this is and how I can change it?

0 Karma

woodcock
Esteemed Legend

There is probably nothing that you can (or at least you nothing that you should) do about it; it is an indication that Splunk is using loopback to process the user session on the search head. What you can do is get rid if the host=My-SearchHead part and you may see other hosts (if you are using Search Head Pooling, etc.). You can also use dnslookup to translate the host (name) to IP address like this:

index=_internal clientip=* sourcetype=splunk_web_access | table user clientip host | dnslookup forward host ip

If you are trying to see what IP addresses are connecting to your search head, you will have to use another method.

0 Karma

hartfoml
Motivator

thanks Much @woodcock for the response. this is an adaptation of a search in the "SplunkApp:Utilization Monitor for Splunk" All users from all splunk systems that are running the web interface are showing the loopback address. Do you. Using the dnslookup i don't think will yearly anything since it is showing the loopback IP.

0 Karma

woodcock
Esteemed Legend

You misunderstand; the dnslookup is on the host, which is your Search Head name, of which there may be many if you are in a cluster or pool, and will return the IP address for each one, not for the loopback IP.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...