All Apps and Add-ons

DNS lookups using CNAME of host entries

New Member

We currently have many systems with names that are meaningless to anyone other than sysadmins, but they have important CNAMEs associated with them that make much more sense to developers who use Splunk for debugging purposes.

For example, we might have a server named "saturn", which logs as such in Splunk and is quick and easy for sysadmins to use for troubleshooting. But the developers refer to it as "prod-live-db-0", which is a DNS CNAME for "saturn".

Is there a way to have Splunk do a DNS lookup on a CNAME and translate it back to the actual server name when doing a search? So if the user searches: host="prod-live-db-0" it will return all messages relevant to host="saturn" (and do this using DNS, i.e., not requiring us to statically define the values in Splunk itself)?

Tags (2)
0 Karma

Path Finder

To my knowledge, there isn't a way with "dnslookup". However if you click on my post below, I've done a similar task by installing the dnspython mod to the splunk python libs:

Using DNSpython mod with open Nameserver

The python example that I posted, looks up the A-record. However if you edit

rawanswer = my_resolver.query(host, 'a')


rawanswer = my_resolver.query(host, 'cname')

Then it should work for you. My syntax may be wrong. It may be 'cn'. But maybe able to assist on the correct syntax. If A-Record works for you then just leave it alone. v/r Pryzrak

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...