topic Re: How do I do a reverse DNS lookup in Splunk? in Splunk Dev

How do I do a reverse DNS lookup in Splunk?

daniel333 — Wed, 23 Jan 2019 01:44:28 GMT

All,

I have the host name, so I am looking for the IP of that host. Not sure how to do that.

any help?
-Daniel

Re: How do I do a reverse DNS lookup in Splunk?

adonio — Wed, 23 Jan 2019 02:09:42 GMT

hello there
if you have lookup table that contains the ip and the host and the fields are: ip, host lets call it dns.csv and you have a search that capture the host
you can run the following search using the lookup command
... your search to find host ... | lookup dns.csv host OUTPUTNEW ip ...

very nice explanation here:
https://answers.splunk.com/answers/588630/understanding-the-lookup-command.html

hope it helps

Re: How do I do a reverse DNS lookup in Splunk?

Michael — Thu, 07 Feb 2019 20:49:24 GMT

That's not a reverse DNS lookup, that's a table lookup.

I think the assumption (and MY question) is that you don't have a csv file...

Question not answered.

Re: How do I do a reverse DNS lookup in Splunk?

peiffer — Fri, 05 Apr 2019 13:17:54 GMT

There has been a lookup dnslookup in splunk for a long time now.
name to ip:

| lookup dnslookup clienthost AS host OUTPUT clientip as ip

ip to name:

| lookup dnslookup clientip AS ip OUTPUT clienthost AS host

Re: How do I do a reverse DNS lookup in Splunk?

peiffer — Thu, 27 May 2021 12:22:31 GMT

Answered 4/5/2019

| lookup dnslookup clientip AS ip OUTPUT clienthost AS host