Why do all clients in splunk_web_access logs have the same IP?

[hartfoml]

When I run this search:

index=_internal  clientip=*  host="My-SearchHead" sourcetype=splunk_web_access | dedup user | table user clientip host

I get this result:

user      clientip   host
MyUser  127.0.0.1   My-SaerchHead 

All the users have the same IP.

Anyone know why this is and how I can change it?

[woodcock]

There is probably nothing that you can (or at least you nothing that you should) do about it; it is an indication that Splunk is using loopback to process the user session on the search head. What you can do is get rid if the host=My-SearchHead part and you may see other hosts (if you are using Search Head Pooling, etc.). You can also use dnslookup to translate the host (name) to IP address like this:

index=_internal clientip=* sourcetype=splunk_web_access | table user clientip host | dnslookup forward host ip

If you are trying to see what IP addresses are connecting to your search head, you will have to use another method.

[hartfoml]

thanks Much @woodcock for the response. this is an adaptation of a search in the "SplunkApp:Utilization Monitor for Splunk" All users from all splunk systems that are running the web interface are showing the loopback address. Do you. Using the dnslookup i don't think will yearly anything since it is showing the loopback IP.

[woodcock]

You misunderstand; the dnslookup is on the host, which is your Search Head name, of which there may be many if you are in a cluster or pool, and will return the IP address for each one, not for the loopback IP.