https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224446#M66113 <P>How do I get the IP from a URL?</P> Wed, 11 Nov 2015 10:28:06 GMT tonifrommknecht 2015-11-11T10:28:06Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224446#M66113 <P>How do I get the IP from a URL?</P> Wed, 11 Nov 2015 10:28:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224446#M66113 tonifrommknecht 2015-11-11T10:28:06Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224447#M66114 <P>Yes, you can use a scripted lookup, which will do a reverse DNS check on a given URL.</P> <P>Please check the example here: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/Knowledge/Addfieldsfromexternaldatasources#Example_of_external_fields_lookup">http://docs.splunk.com/Documentation/Splunk/5.0.4/Knowledge/Addfieldsfromexternaldatasources#Example_of_external_fields_lookup</A></P> <P>This is for an older version of Splunk, but the script is still shipped, and can be used as described.</P> Wed, 11 Nov 2015 13:32:38 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224447#M66114 DMohn 2015-11-11T13:32:38Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224448#M66115 <P>Use rex command in search, use sedcmd in props. Did you want to make the ip address an indexed field or search time extraction?</P> <PRE><CODE> |rex field=urlField "[regex_to_capture_ip]" |rex field=urlField "(?&lt;IP&gt;(\d+\.\d+\.\d+\.\d+))" </CODE></PRE> Wed, 11 Nov 2015 13:35:44 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224448#M66115 jkat54 2015-11-11T13:35:44Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224449#M66116 <P>To use DNS in order to resolve a CNAME like yahoo.com to its A or AAAA records, please use the answer posed by DMohn.</P> <P>If you have an IP address in a URL field, please use my answer.</P> Fri, 13 Nov 2015 13:20:16 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-resolve-an-IP-Address-from-a-URL-in-the-Search/m-p/224449#M66116 jkat54 2015-11-13T13:20:16Z