All Apps and Add-ons

How run nslookup on lookup

NHLaurent
Explorer

I have a lookup of ip addresses, I want to use the nslookup command resolve the hostnames. Is there a way to run that against the dest field

| inputlookup "ipnl.csv"
| fields dest
| nslookup ????
| outputlookup "dns.csv"

Thanks

0 Karma

woodcock
Esteemed Legend

Ever since about splunk v5 it is built-in; just use it like this:

| inputlookup ipnl.csv
| fields dest 
| lookup dnslookup clientip AS dest OUTPUT clienthost AS desthost
| outputlookup dns.csv

LukeMurphey
Champion

You need to use the custom lookup command instead.

See https://lukemurphey.net/projects/network-tools/wiki/Using_Lookups for details.

You would need to do something like this:

| inputlookup "ipnl.csv" 
| fields dest 
| lookup nslookup host as dest
| table _raw aaaa a mx ns server

sharmaa5
Engager

Hi @LukeMurphey ,

 

I'm trying to configure DNS resolution for the but I'm a bit confused that how to use lookup defination dsnlookup and nslookup.

I'm not getting any values in aaaa, mx, ns and _raw while trying nslookup 

Can you help me out how can I configure this or what I'm doing wrong.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...