topic Re: Using |lookup whois on domain name in All Apps and Add-ons

Using |lookup whois on domain name

skyelowryvancit — Thu, 10 Oct 2019 22:15:13 GMT

I have a lookup table ipn1.csv
src_ip,hostname
54.69.58.243,splunk.com
172.217.14.206,google.com

When I run:

   | inputlookup "ipn1.csv"
  | lookup whois host as src_ip

(lookup whois information based on the IP address) I get information populated from the whois search

When I run:

| inputlookup "ipn1.csv"
 | lookup whois host as hostname

(lookup whois information based on the domain name) no information is populated.

In my use case, I want to take a domain name from a search and lookup the creation_date but I cannot seem to get results.

When doing

|whois splunk.com

it works perfectly, just not within a runtime search.

Re: Using |lookup whois on domain name

Prewin027 — Mon, 14 Oct 2019 04:54:23 GMT

Hi,
From your question i understand that, you want to take domain name from your search and compare the same with a lookup table to fetch creation date.

For this,

|inputlookup "ipn1.csv" |fields hostname |rename hostname as host| lookup whois host OUTPUT creation_date

Re: Using |lookup whois on domain name

skyelowryvancit — Tue, 15 Oct 2019 17:40:10 GMT

I was only using the table to illustrate my problem.

My issue is that whois query will work when called by |lookup whois using the IP address, but not the Hostname.

Hostname only works when using |whois and not |lookup whois

Re: Using |lookup whois on domain name

robert_miller — Thu, 30 Apr 2020 19:35:04 GMT

Hey @skyelowryvancity , I can't get that lookup command to work. What version of the app are you using?