Splunk Search

Does Splunk do Internet Name Resolution?

garciatdg
New Member

I am doing an experiment at home to capture Internet traffic for all of my devices in my house connected to my home wi-fi. I heard in a conference that a guy setup Splunk Streaming on his splunk instance and was able to capture all traffic between his wireless router and any device in his house.

sourcetype="stream:ip" src_ip="192.168.1.16"
| stats count by dest_ip

I put this quick query together but I don't think I'm capturing everything, but I'd also like to have splunk resolve the Dest_IP
For example, if I pull up Google.com, I'd like to see in a Splunk Table "google.com" and not "172.217.5.78"

my results are as follows

alt text

Tags (1)
0 Karma

woodcock
Esteemed Legend

Yes, assuming DNS is accessible by the search head, just add this to the bottom:

... | lookup dnslookup clientip AS dest_ip
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...