https://community.splunk.com/t5/Getting-Data-In/Running-Batch-Script-for-NetBios-name-resolution/m-p/142259#M29102 <P>If you are using Windows DHCP then you can monitor that and as it gives out assignments, log that. You can read about the log file here: <A href="http://technet.microsoft.com/en-us/library/dd759178.aspx" target="_blank">http://technet.microsoft.com/en-us/library/dd759178.aspx</A></P> <P>Once you have the data, create a temporal lookup of _time,src_ip,src_host and use that. Read about temporal lookups here: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-bounded_lookup" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-bounded_lookup</A></P> Mon, 28 Sep 2020 18:17:49 GMT ahall_splunk 2020-09-28T18:17:49Z https://community.splunk.com/t5/Getting-Data-In/Running-Batch-Script-for-NetBios-name-resolution/m-p/142258#M29101 <P>We currently have several logs that only capture the IP address of the asset performing the activity. A simple "nbtstat -a " will return the name of the asset within the windows command prompt. Is there a way we can automate this name resolution through automatically running a batch (.bat) file when it returns the first ten results (e.g. top 10)? Since the host names will depend on the current IP Address assignment it seems that this will need to be done as close to real time as possible.</P> <P>Any suggestions or workarounds? Thank you!</P> Wed, 03 Dec 2014 15:39:16 GMT https://community.splunk.com/t5/Getting-Data-In/Running-Batch-Script-for-NetBios-name-resolution/m-p/142258#M29101 NateStreet 2014-12-03T15:39:16Z https://community.splunk.com/t5/Getting-Data-In/Running-Batch-Script-for-NetBios-name-resolution/m-p/142259#M29102 <P>If you are using Windows DHCP then you can monitor that and as it gives out assignments, log that. You can read about the log file here: <A href="http://technet.microsoft.com/en-us/library/dd759178.aspx" target="_blank">http://technet.microsoft.com/en-us/library/dd759178.aspx</A></P> <P>Once you have the data, create a temporal lookup of _time,src_ip,src_host and use that. Read about temporal lookups here: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-bounded_lookup" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-bounded_lookup</A></P> Mon, 28 Sep 2020 18:17:49 GMT https://community.splunk.com/t5/Getting-Data-In/Running-Batch-Script-for-NetBios-name-resolution/m-p/142259#M29102 ahall_splunk 2020-09-28T18:17:49Z