Does Splunk do Internet Name Resolution?

New Member

I am doing an experiment at home to capture Internet traffic for all of my devices in my house connected to my home wi-fi. I heard in a conference that a guy setup Splunk Streaming on his splunk instance and was able to capture all traffic between his wireless router and any device in his house.

sourcetype="stream:ip" src_ip=""
| stats count by dest_ip

I put this quick query together but I don't think I'm capturing everything, but I'd also like to have splunk resolve the Dest_IP
For example, if I pull up, I'd like to see in a Splunk Table "" and not ""

my results are as follows

alt text

Tags (1)
0 Karma

Re: Does Splunk do Internet Name Resolution?

Esteemed Legend

Yes, assuming DNS is accessible by the search head, just add this to the bottom:

... | lookup dnslookup clientip AS dest_ip
0 Karma