All Apps and Add-ons

How run nslookup on lookup

NHLaurent
Explorer

I have a lookup of ip addresses, I want to use the nslookup command resolve the hostnames. Is there a way to run that against the dest field

| inputlookup "ipnl.csv"
| fields dest
| nslookup ????
| outputlookup "dns.csv"

Thanks

0 Karma

woodcock
Esteemed Legend

Ever since about splunk v5 it is built-in; just use it like this:

| inputlookup ipnl.csv
| fields dest 
| lookup dnslookup clientip AS dest OUTPUT clienthost AS desthost
| outputlookup dns.csv

LukeMurphey
Champion

You need to use the custom lookup command instead.

See https://lukemurphey.net/projects/network-tools/wiki/Using_Lookups for details.

You would need to do something like this:

| inputlookup "ipnl.csv" 
| fields dest 
| lookup nslookup host as dest
| table _raw aaaa a mx ns server

sharmaa5
Engager

Hi @LukeMurphey ,

 

I'm trying to configure DNS resolution for the but I'm a bit confused that how to use lookup defination dsnlookup and nslookup.

I'm not getting any values in aaaa, mx, ns and _raw while trying nslookup 

Can you help me out how can I configure this or what I'm doing wrong.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...