@jip31 I know this is an older post, but if you don't have the External Public Egress IPs from your UFs or Enterprise, you can use our Get Public IP Add-on to collect them: https://splunkbase.splunk.com/app/8107 ... View more

@brandonmurphy I know this is an old post, but for those looking to index External Public Egree IPs (IPv4 and IPv6) from Splunk UFs or Splunk Enterprise, we built this Get Public IP Add-on: https://splunkbase.splunk.com/app/8107 ... View more

FYI, it's on official Splunkbase now: https://splunkbase.splunk.com/app/8107 ... View more

No prob! We just updated it to v1.1.0 to support IPv6 too. So you can index ipv4 and ipv6 automatically or choose which one you want. ... View more

@snakhuda We built this for the external public IP portion if you need it still: https://zuykn.io/apps/splunk https://github.com/zuykn/TA-get_public_ip Get Public IP Add-on ━━━━━━━━━━━ A lightweight, cross-platform add-on that collects your Splunk Forwarder’s external public IPv4 address using native system commands only — implemented in Windows Batch (.bat) and POSIX sh (Linux / Unix / macOS). ━━━━━━━━━━━ ⚙️Highlights • HTTPS or DNS lookup with intelligent fallback • No dependencies — built-in system tools only • Auto-selects commands: 　↳ Windows → curl, certutil, bitsadmin, nslookup 　↳ Linux / macOS → curl, wget, dig, nslookup • Works with any IPv4-returning site — checkip.amazonaws.com, ipinfo.io/ip, icanhazip.com, etc. Let me know if you have any questions! - Seth ... View more