Receiving logs from x hosts is +1 more than the Top Sources

[Box293]

On my main dashboard I see:

Receiving logs from 5 hosts.

When I open the Top Sources and Types dashboard I see:

Code: Select all

Term					Count
10.25.6.51			362991	
10.25.1.254			119833	
10.25.2.1				23380	
0:0:0:0:0:0:0:1		15843	

That's only 4 Hosts.

Am I correct in assuming that the message "Receiving logs from 5 hosts" is detecting the localhost "127.0.0.1 and 0:0:0:0:0:0:0:1" and counting both, where as the "Top Sources and Types dashboard" is smart enough to count them as 1?

If that's not the case, how do I determine what all 5 hosts are?

[lmiltchev]

It may be hiding localhost but still counting it, which could explain the inconsistency. Our developers will be looking into this to determine the exact cause of the issue.

[eloyd]

My experience is the same, and I chalked it up to the IPv6 address showing up, just as Box is. Ideally, I'd like to see only IPv4 IPs in the list and am thinking about putting in a filter to change 0...1 to 127.0.0.1.

[lmiltchev]

Thanks for the feedback, eloyd!