topic Resolve IP Addresses Within Report Results? in Reporting

Resolve IP Addresses Within Report Results?

aferone — Tue, 12 Jul 2011 14:23:15 GMT

For example, within a simple firewall search report, I am looking for destination IP addresses coming from a certain source IP address. Can I generate a report that will show each destination IP address, count them, then show the resolved hostname for each found destination IP address?

Thanks!

Re: Resolve IP Addresses Within Report Results?

dwaddle — Tue, 12 Jul 2011 16:33:05 GMT

This can be accomplished with a scripted lookup. Seems like there is one of these already built into splunk as an example. The script itself is $SPLUNK_HOME/etc/system/bin/external_lookup.py. There's an example of using it at http://www.splunk.com/base/Documentation/4.2.2/Knowledge/Addfieldsfromexternaldatasources under "Example of external fields lookup "

Re: Resolve IP Addresses Within Report Results?

aferone — Tue, 12 Jul 2011 17:49:21 GMT

I"ll give it a shot! Thanks!