topic Re: Can I specify a name server for DNS in Getting Data In

Can I specify a name server for DNS

echalex — Thu, 18 Oct 2012 14:28:54 GMT

Hi,

We are having some DNS issues in our infrastructure. Apparently the name servers our splunk hosts are using are not able to resolve some PTR queries, because of our network topology. Unfortunately, simply editing /etc/resolv.conf would also break stuff. So I need to use a different name server than the system is using by default. Is this possible?

Re: Can I specify a name server for DNS

yannK — Thu, 18 Oct 2012 16:00:54 GMT

not sure, Splunk will use a system call for the resolution, so your default DNS will be used.

Re: Can I specify a name server for DNS

echalex — Fri, 19 Oct 2012 10:15:58 GMT

Thanks, yannK.

That is what I suspected. Even the reverse dns lookup script will use the default configuration. Of course, I can do my own reverse lookup script in eg. perl.

Re: Can I specify a name server for DNS

pryzrak — Mon, 28 Sep 2020 15:15:00 GMT

I know it is possible if the dnspython module is installed. I tried it with a successful standalone script. However I'm trying to edit a renamed external_lookup.py script as something like "opendns_lookup.py". Then I edited the transforms.conf to make a new command called "opendnslookup". However I can't get "opendns_lookup.py" to work right. Look at my splunk post below on this matter and let me know what yall think:

Editing dnslookup for specific dns server

Re: Can I specify a name server for DNS

pryzrak — Fri, 15 Nov 2013 22:55:31 GMT

Not sure if this post is still being reviewed. However I now have a working python script that resolves from IP to HOST and HOST to IP using an external nameserver like the open Google DNS. Look at my above post to see the answer.