Fetching out ISP , domain info for an IP address

neerajs_81 — Wed, 11 Oct 2023 07:07:41 GMT

Hi All, We are a Splunk Cloud customer having ES. Is there a way to fetch the ISP, domain info for an IP address directly in the splunk results ? I have looked at this post : https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-query-whois-by-ip/m-p/316975 but Domain Tools add on requires a paid subscription.
Alternatively i know that we can setup a workflow to perform whois lookup via right click implementation but that is again a manual task and it ends up redirecting us to whois website. I am looking for something open source that can fetch me the ISP and domain for an IP-address easily.

Any thoughts or suggestions ? Any ES users how do you accomplish this ?

Re: Fetching out ISP , domain info for an IP address

joukahainen123 — Thu, 25 Jan 2024 12:26:10 GMT

Check the addon ASN Lookup Generator

https://splunkbase.splunk.com/app/3531

First

| asngen | table ip asn autonomous_system | outputlookup asn

And then

source="yourdata" | iplocation youriptable | table youriptable, City, Country | lookup asn ip AS IPaddress

topic Re: Fetching out ISP , domain info for an IP address in Splunk Search

Fetching out ISP , domain info for an IP address

Re: Fetching out ISP , domain info for an IP address