All Apps and Add-ons

Using |lookup whois on domain name

skyelowryvancit
Explorer

I have a lookup table ipn1.csv
src_ip,hostname
54.69.58.243,splunk.com
172.217.14.206,google.com

When I run:

   | inputlookup "ipn1.csv"
  | lookup whois host as src_ip

(lookup whois information based on the IP address) I get information populated from the whois search

When I run:

| inputlookup "ipn1.csv"
 | lookup whois host as hostname

(lookup whois information based on the domain name) no information is populated.

In my use case, I want to take a domain name from a search and lookup the creation_date but I cannot seem to get results.

When doing

|whois splunk.com 

it works perfectly, just not within a runtime search.

0 Karma

Prewin027
Explorer

Hi,
From your question i understand that, you want to take domain name from your search and compare the same with a lookup table to fetch creation date.

For this,

|inputlookup "ipn1.csv" |fields hostname |rename hostname as host| lookup whois host OUTPUT creation_date

0 Karma

skyelowryvancit
Explorer

I was only using the table to illustrate my problem.

My issue is that whois query will work when called by |lookup whois using the IP address, but not the Hostname.

Hostname only works when using |whois and not |lookup whois

0 Karma

robert_miller
Path Finder

Hey @skyelowryvancity , I can't get that lookup command to work. What version of the app are you using?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...