All Apps and Add-ons

Using |lookup whois on domain name

skyelowryvancit
Explorer

I have a lookup table ipn1.csv
src_ip,hostname
54.69.58.243,splunk.com
172.217.14.206,google.com

When I run:

   | inputlookup "ipn1.csv"
  | lookup whois host as src_ip

(lookup whois information based on the IP address) I get information populated from the whois search

When I run:

| inputlookup "ipn1.csv"
 | lookup whois host as hostname

(lookup whois information based on the domain name) no information is populated.

In my use case, I want to take a domain name from a search and lookup the creation_date but I cannot seem to get results.

When doing

|whois splunk.com 

it works perfectly, just not within a runtime search.

0 Karma

Prewin027
Explorer

Hi,
From your question i understand that, you want to take domain name from your search and compare the same with a lookup table to fetch creation date.

For this,

|inputlookup "ipn1.csv" |fields hostname |rename hostname as host| lookup whois host OUTPUT creation_date

0 Karma

skyelowryvancit
Explorer

I was only using the table to illustrate my problem.

My issue is that whois query will work when called by |lookup whois using the IP address, but not the Hostname.

Hostname only works when using |whois and not |lookup whois

0 Karma

robert_miller
Path Finder

Hey @skyelowryvancity , I can't get that lookup command to work. What version of the app are you using?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...