topic Re: Convert IP address into hostname in Splunk Search

Convert IP address into hostname

sympatiko — Fri, 03 Jul 2015 04:21:08 GMT

Hi,

Is there a way on search query to resolve any IP result into hostname?

Thanks

Re: Convert IP address into hostname

woodcock — Fri, 03 Jul 2015 04:24:26 GMT

You need the dnslookup app:

https://splunkbase.splunk.com/app/1535/

Re: Convert IP address into hostname

sympatiko — Fri, 03 Jul 2015 08:14:21 GMT

Hi Im getting an "Unknown search command 'dnslookup'

Re: Convert IP address into hostname

woodcock — Fri, 03 Jul 2015 13:28:58 GMT

Did you install the app on your Search Head? That is all I did and it worked great. It isn't my app so I would read through the app documentation and make sure that you have all prerequisites and see if there are any notes that will help you.

Re: Convert IP address into hostname

martin_mueller — Sat, 04 Jul 2015 00:25:17 GMT

No app needed, Splunk comes with a DNS lookup out of the box:

some search returning a field called ip | lookup dnslookup clientip as ip OUTPUT clienthost as your_shiny_host_field