REST Archives - ISbyR https://isbyr.com/tag/rest/ Infrequent Smarts by Reshetnikov Sat, 04 Jan 2020 00:25:42 +0000 en-US hourly 1 https://wordpress.org/?v=6.7.2 Splunk – List REST API users and their IPs https://isbyr.com/splunk-list-rest-api-users-and-their-ips/ https://isbyr.com/splunk-list-rest-api-users-and-their-ips/#respond Thu, 17 Oct 2019 05:40:04 +0000 http://isbyr.com/?p=554 Want to get a list REST API users and their IPs? Run this search index=_internal host IN(SH1,SH2,SH3) sourcetype=splunkd_access user != "-" clientip != "IP_of_SH1" clientip != "IP_of_SH2" clientip != “IP_of_SH3” NOT TERM(127.0.0.1) NOT TERM(splunk-system-user) | stats values(clientip) by user The limitation is if the users are going via a Load Balancer, you will see  Load Balancer’s … Continue reading Splunk – List REST API users and their IPs →

The post Splunk – List REST API users and their IPs appeared first on ISbyR.

]]> Want to get a list REST API users and their IPs?

Run this search

index=_internal
host IN(SH1,SH2,SH3)
sourcetype=splunkd_access
user != "-"
clientip != "IP_of_SH1" clientip != "IP_of_SH2" clientip != “IP_of_SH3”
NOT TERM(127.0.0.1)
NOT TERM(splunk-system-user)
| stats values(clientip) by user

The limitation is if the users are going via a Load Balancer, you will see  Load Balancer’s IP as the clientip

The post Splunk – List REST API users and their IPs appeared first on ISbyR.

]]> https://isbyr.com/splunk-list-rest-api-users-and-their-ips/feed/ 0