Splunk Search

How can I use iplocation to include the IP in my alert search results for account lockouts?

Gayathirik
Path Finder

I have a search to alert on account lockouts:

index=winsec EventCodeDescription="A user account was locked out"|dedup user| stats count as total by _time host user 

I need to get the "IP" as well when the account is locked out. Could you please help me on getting the IP address of the system along with this event alert search?

Regards,
Gayathiri K

1 Solution

hliakathali_spl
Splunk Employee
Splunk Employee

You would have to use some DNSlookup type of things to get IP address from host name. And you can use clientip, src_ip, dns_ip, server_ip..Etc according to your Splunk naming conversion you have to use the search strings. See the props.conf file for host and ip

Try to use this query,

index=_audit action="login attempt" info="succeeded"| head 20 | iplocation clientip | table clientip, user, _time

View solution in original post

sundareshr
Legend

Try this

index=winsec EventCodeDescription="A user account was locked out"| stats count as total by _time host user Source_Network_Address
0 Karma

Gayathirik
Path Finder

This is not working..Could you please tell me some other possible way to find it out?

0 Karma

hliakathali_spl
Splunk Employee
Splunk Employee

You would have to use some DNSlookup type of things to get IP address from host name. And you can use clientip, src_ip, dns_ip, server_ip..Etc according to your Splunk naming conversion you have to use the search strings. See the props.conf file for host and ip

Try to use this query,

index=_audit action="login attempt" info="succeeded"| head 20 | iplocation clientip | table clientip, user, _time

Gayathirik
Path Finder

Excellent Harish!!! This really works!!!!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...