Developing for Splunk Enterprise

How to create an NSLookup script that allows you to right-click an IP to get the name and address information?

Contributor

Any one have any luck creating an NSlookup script that allows you to right-click an IP and get the Name/Address Info?

I am thinking about using a Python script.

Any pointers, don't want to reinvent the wheel...

Thank you

Tags (4)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Simpler and pure Simple XML solution would be to add a drilldown capability on IP field.
Alternatively (what I did) - create a another field right next to IP, name it "Whois" and make click on this field to open new browser tab to execute "whois" on IP.

Such as:

  ...
  <row>
    <panel>
      <table>
        <title>Investigation Results</title>
        <searchPostProcess base="root_search">
          ...
        </searchPostProcess>
        <drilldown target="_blank">
          <link field="Whois">
            <![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
          </link>
        </drilldown>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="count">15</option>
      </table>
    </panel>
  </row>    ...

In above case - clicking on "Whois" field will open new browser tab where value of "src_ip" field will be taken and sent as a parameter to "who.is" service. Feel free to replace this with another service of your choice.

View solution in original post

Splunk Employee
Splunk Employee

Simpler and pure Simple XML solution would be to add a drilldown capability on IP field.
Alternatively (what I did) - create a another field right next to IP, name it "Whois" and make click on this field to open new browser tab to execute "whois" on IP.

Such as:

  ...
  <row>
    <panel>
      <table>
        <title>Investigation Results</title>
        <searchPostProcess base="root_search">
          ...
        </searchPostProcess>
        <drilldown target="_blank">
          <link field="Whois">
            <![CDATA[ http://who.is/whois-ip/ip-address/$row.src_ip$ ]]>
          </link>
        </drilldown>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="count">15</option>
      </table>
    </panel>
  </row>    ...

In above case - clicking on "Whois" field will open new browser tab where value of "src_ip" field will be taken and sent as a parameter to "who.is" service. Feel free to replace this with another service of your choice.

View solution in original post

Contributor

Thank you very much I will give it a shot and let you know how it goes.

0 Karma