topic Re: resolving hostnames from a mail log in Getting Data In

resolving hostnames from a mail log

christerhe — Thu, 05 Dec 2013 14:06:19 GMT

I'm a beginner at this... but i love to know more!

I have a mail log that i like to extract the connection hostname from.
I have sorted out all the intresting lines:

"
Dec 1 04:02:42 mailgw1 postfix/smtpd[15515]: connect from unknown[XXX.YYY.ZZZ.NNN]
"

But when i try to get the IPadresses to hostnames i just hit the brick wall 😞

I'm ending up with a list of "unknown[XXX.YYY.ZZZ.NNN]" and i just love to resolve that to a hostname and make a nice chart for the boss... and a clear list for the developer that are trying to change mail system...

Re: resolving hostnames from a mail log

lukejadamec — Thu, 05 Dec 2013 14:34:48 GMT

It sounds like you are looking to resolve the host name from an IP. Splunk ships with a script that can do this at index time, which means once configured only new events will be resolved.

Check out this answer:

http://answers.splunk.com/answers/105246/dns-resolution-in-a-search

Re: resolving hostnames from a mail log

muebel — Thu, 05 Dec 2013 17:02:12 GMT

To add to Luke's answer, this script and lookup mechanism is described in the Splunk documentation