Archive
Highlighted

Why Splunk external_lookup.py is not able to resolve external DNS IP

Contributor

Hi,

I am using external_lookup.py in Splunk to resolve the IPs/hostnames and get the respective hostnames/IPs. I could see that the python script is only able to resolve the internal IPs/hostnames but not external IPs/hostnames like www.google.com or so. I am assuming that because of the proxy it's not able to resolve the external IPs/hostnames. If anyone has tried this before, can you please guide me how can I achieve that?

Thank you!

0 Karma
Highlighted

Re: Why Splunk external_lookup.py is not able to resolve external DNS IP

SplunkTrust
SplunkTrust

Hi @MousumiChowdhury,

If you look at externallookup.py script, it uses python socket module which interacts with OS name resolution (DNS) server, if DNS server which is configured in OS (On which splunk is running) is blocking any external name resolution then you can't resolve external IP/hostnames with externallookup.py script and you might need to create your own script which use proxy IP for name resolution on external DNS servers but I am not expert on this so can't help much more here.

0 Karma
Highlighted

Re: Why Splunk external_lookup.py is not able to resolve external DNS IP

Esteemed Legend

Are you using it like this?

| makeresults | eval clienthost = "google.com"
| lookup dnslookup clienthost

This should generate an output field called clientip

0 Karma
Highlighted

Re: Why Splunk external_lookup.py is not able to resolve external DNS IP

Contributor

Hi @woodcock ,

Ya I could get an output field clientip for the internal host names but not external host names. Later just found that resolving any external host names is out of scope for the available name server.

0 Karma
Highlighted

Re: Why Splunk external_lookup.py is not able to resolve external DNS IP

Contributor

Hi,

After spending some time on troubleshooting, I found that the name server that is there for my Search heads can only resolve internal IPs/Hostnames. Resolving external IPs/Hostnames is out of scope for the name server.

Thank you.

View solution in original post

0 Karma