topic Re: How to create an NSLookup script that allows you to right-click an IP to get the name and address information? in Splunk Dev

How to create an NSLookup script that allows you to right-click an IP to get the name and address information?

packet_hunter — Tue, 20 Dec 2016 22:55:10 GMT

Any one have any luck creating an NSlookup script that allows you to right-click an IP and get the Name/Address Info?

I am thinking about using a Python script.

Any pointers, don't want to reinvent the wheel...

Thank you

Re: How to create an NSLookup script that allows you to right-click an IP to get the name and address information?

gesman_splunk — Wed, 21 Dec 2016 01:50:35 GMT

Simpler and pure Simple XML solution would be to add a drilldown capability on IP field.
Alternatively (what I did) - create a another field right next to IP, name it "Whois" and make click on this field to open new browser tab to execute "whois" on IP.

Such as:

  ...
  <row>
    <panel>
      <table>
        <title>Investigation Results</title>
        <searchPostProcess base="root_search">
          ...
        </searchPostProcess>
        <drilldown target="_blank">
          <link field="Whois">
            <![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
          </link>
        </drilldown>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="count">15</option>
      </table>
    </panel>
  </row>    ...

In above case - clicking on "Whois" field will open new browser tab where value of "src_ip" field will be taken and sent as a parameter to "who.is" service. Feel free to replace this with another service of your choice.

Re: How to create an NSLookup script that allows you to right-click an IP to get the name and address information?

packet_hunter — Thu, 22 Dec 2016 17:41:08 GMT

Thank you very much I will give it a shot and let you know how it goes.