Folks, Need some assistance to understand why Splunk is reporting different IP's for the same hostname ( Active Dir Server) even though the AD server has only one static IP ip assigned to it.
For example: Lets assume my AD server is : AD01.domain.com with IP 1.2.3.4
Now if i run the search to group events where the src host is AD01,
index=ad
|stats list(action) by src, src_ip| where src="AD01.domain.com"
it shows following results ...where there is different src-IP for every event for the same Host AD01
src | src_ip | list(action) | |
AD01.domain.com | 2.3.4.5 | success | |
AD01.domain.com | 10.76.12.102 | success | |
AD01.domain.com | 10.x.12.101 | success | |
AD01.domaincom | x.x.x.x | failure |
Why so ?
Why would it be the same IP always? It's the source IP of an object referenced in an event. So if the event is, for example 4624, you'll have the IP of the user's workstation.
Thank you for clarifying that. What field can we then use for grouping events ( based on Event ID 4624 or 4625) going to AD server from same source machine ? If i run the below search, the Workstation_name field shows the client's laptop name (which is what we want) in some events, but in some, it shows the Hostname of the AD server itself and finally in some events it is <empty>.
index=ad source="WinEventLog:Security" EventCode IN(4625)
It's more of a windows question, not a splunk one 😉
I'm not a big windows guru but I suppose each event's fields depend on context. Some logon request could come from the servers themselves probably (if generated by services running on those servers).