Page 1 of 1

Receiving logs from x hosts is +1 more than the Top Sources

Posted: Wed Jan 21, 2015 9:36 pm
by Box293
On my main dashboard I see:
Receiving logs from 5 hosts.
When I open the Top Sources and Types dashboard I see:

Code: Select all

Term					Count
10.25.6.51			362991	
10.25.1.254			119833	
10.25.2.1				23380	
0:0:0:0:0:0:0:1		15843	
That's only 4 Hosts.

Am I correct in assuming that the message "Receiving logs from 5 hosts" is detecting the localhost "127.0.0.1 and 0:0:0:0:0:0:0:1" and counting both, where as the "Top Sources and Types dashboard" is smart enough to count them as 1?

If that's not the case, how do I determine what all 5 hosts are?

Re: Receiving logs from x hosts is +1 more than the Top Sour

Posted: Thu Jan 22, 2015 1:08 pm
by lmiltchev
It may be hiding localhost but still counting it, which could explain the inconsistency. Our developers will be looking into this to determine the exact cause of the issue.

Re: Receiving logs from x hosts is +1 more than the Top Sour

Posted: Thu Jan 22, 2015 1:11 pm
by eloyd
My experience is the same, and I chalked it up to the IPv6 address showing up, just as Box is. Ideally, I'd like to see only IPv4 IPs in the list and am thinking about putting in a filter to change 0...1 to 127.0.0.1.

Re: Receiving logs from x hosts is +1 more than the Top Sour

Posted: Thu Jan 22, 2015 2:26 pm
by lmiltchev
Thanks for the feedback, eloyd!