DNS lookups using CNAME of host entries

[gudlyf]

We currently have many systems with names that are meaningless to anyone other than sysadmins, but they have important CNAMEs associated with them that make much more sense to developers who use Splunk for debugging purposes.

For example, we might have a server named "saturn", which logs as such in Splunk and is quick and easy for sysadmins to use for troubleshooting. But the developers refer to it as "prod-live-db-0", which is a DNS CNAME for "saturn".

Is there a way to have Splunk do a DNS lookup on a CNAME and translate it back to the actual server name when doing a search? So if the user searches: host="prod-live-db-0" it will return all messages relevant to host="saturn" (and do this using DNS, i.e., not requiring us to statically define the values in Splunk itself)?

[pryzrak]

To my knowledge, there isn't a way with "dnslookup". However if you click on my post below, I've done a similar task by installing the dnspython mod to the splunk python libs:

Using DNSpython mod with open Nameserver

The python example that I posted, looks up the A-record. However if you edit

rawanswer = my_resolver.query(host, 'a')

to

rawanswer = my_resolver.query(host, 'cname')

Then it should work for you. My syntax may be wrong. It may be 'cn'. But www.dnspython.org maybe able to assist on the correct syntax. If A-Record works for you then just leave it alone. v/r Pryzrak