Windows Events - Why does SRC_IP for an Active Directory Server appears different in different events?

[neerajs_81]

Folks,  Need some assistance to understand why Splunk is reporting different IP's for the same hostname ( Active Dir Server) even though  the AD server has only one static IP ip assigned to it.
For example:  Lets assume my AD server is :   AD01.domain.com with IP  1.2.3.4 

Now if i  run the search to group events where the src host is AD01, 

index=ad 
|stats list(action) by src, src_ip| where src="AD01.domain.com"

 it shows following results ...where  there is different src-IP for every event for the same Host AD01

src	src_ip	list(action)
AD01.domain.com	2.3.4.5	success
AD01.domain.com	10.76.12.102	success
AD01.domain.com	10.x.12.101	success
AD01.domaincom	x.x.x.x	failure

Why so ?

[PickleRick]

Why would it be the same IP always? It's the source IP of an object referenced in an event. So if the event is, for example 4624, you'll have the IP of the user's workstation.

[neerajs_81]

Thank you for clarifying that. What field can we then use for grouping events ( based on Event ID 4624 or 4625) going to AD server  from same source machine ? If i run the below search, the Workstation_name  field shows the client's laptop name  (which is what we want) in some events, but in some,  it shows  the Hostname of the AD server itself   and finally in some events it is <empty>.

index=ad source="WinEventLog:Security" EventCode IN(4625)

[PickleRick]

It's more of a windows question, not a splunk one 😉

I'm not a big windows guru but I suppose each event's fields depend on context. Some logon request could come from the servers themselves probably (if generated by services running on those servers).