Hi, i am trying to do a search which can shows which internal client accessed the web but i have a proxy to access the web on behalf. So i have a internal client X.X.X.X my proxy internal IP is IP.IP.IP.IP my proxy external IP is EP.EP.EP.EP so i have a search index=* 8.8.8.8 The above search will show that my proxy(EP.EP.EP.EP) access this IP. So from here i would like to based on this result i need to search index=proxy where my IP is IP.IP.IP.IP to see which internal client access this 8.8.8.8 Can anyone guide me on how should i write my splunk search?
... View more