topic Re: nslookup TXT queries with Splunk in Splunk Search

nslookup TXT queries with Splunk

urana — Mon, 06 May 2019 15:25:43 GMT

I am trying to see if its possible to run nslookup -q=TXT domain 8.8.8.8 so i can compare the results of the output to an existing lookup csv file.

Re: nslookup TXT queries with Splunk

efavreau — Mon, 06 May 2019 20:11:52 GMT

Do either of these help? If not, why not?
https://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html
https://answers.splunk.com/answers/8051/dns-lookup-via-splunk.html

Re: nslookup TXT queries with Splunk

MuS — Mon, 06 May 2019 20:24:57 GMT

Hi urana,

The default shipped command dnslookup does not provide this functionality. If you need a fully featured command like linux dig you would need to created a custom search command yourself. It could be as easy as creating a wrapper for dig and output thew results to Splunk 😉 See the docs for an example to write a custom search command https://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape

Hope this helps ...

cheers, MuS

Re: nslookup TXT queries with Splunk

manasbellani — Tue, 11 Feb 2020 00:50:40 GMT

While it may not be possible to do TXT queries out of the box, an app has now been created for this here

This app adds a custom dnsquery command which utilizes dnspython package under the hood and allows you to do DNS queries on hostnames - tested to work for CNAME, MX, TXT, A, PTR records.