https://community.splunk.com/t5/Splunk-Search/Does-Splunk-do-Internet-Name-Resolution/m-p/463685#M191512 <P>Yes, assuming DNS is accessible by the search head, just add this to the bottom:</P> <PRE><CODE>... | lookup dnslookup clientip AS dest_ip </CODE></PRE> Fri, 03 Apr 2020 12:16:29 GMT woodcock 2020-04-03T12:16:29Z https://community.splunk.com/t5/Splunk-Search/Does-Splunk-do-Internet-Name-Resolution/m-p/463684#M191511 <P>I am doing an experiment at home to capture Internet traffic for all of my devices in my house connected to my home wi-fi. I heard in a conference that a guy setup Splunk Streaming on his splunk instance and was able to capture all traffic between his wireless router and any device in his house. </P> <PRE><CODE>sourcetype="stream:ip" src_ip="192.168.1.16" | stats count by dest_ip </CODE></PRE> <P>I put this quick query together but I don't think I'm capturing everything, but I'd also like to have splunk resolve the Dest_IP<BR /> For example, if I pull up Google.com, I'd like to see in a Splunk Table "google.com" and not "172.217.5.78"</P> <P>my results are as follows</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8621i7D0A1AA482695989/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 03 Apr 2020 01:28:25 GMT https://community.splunk.com/t5/Splunk-Search/Does-Splunk-do-Internet-Name-Resolution/m-p/463684#M191511 garciatdg 2020-04-03T01:28:25Z https://community.splunk.com/t5/Splunk-Search/Does-Splunk-do-Internet-Name-Resolution/m-p/463685#M191512 <P>Yes, assuming DNS is accessible by the search head, just add this to the bottom:</P> <PRE><CODE>... | lookup dnslookup clientip AS dest_ip </CODE></PRE> Fri, 03 Apr 2020 12:16:29 GMT https://community.splunk.com/t5/Splunk-Search/Does-Splunk-do-Internet-Name-Resolution/m-p/463685#M191512 woodcock 2020-04-03T12:16:29Z