Developing for Splunk Enterprise

How to resolve top 10 ip addresses

pjb2160
Path Finder

So, I'm running the following on some logs which have the dest_ip but no url. I want to report on the top domains by bandwidth:

index=proxy bytes=* 
| fields + user dest_ip bytes bytes_in bytes_out 
| stats sum(bytes) as total_bytes sum(bytes_in) as total_bytes_in sum(bytes_out) as total_bytes_out by dest_ip 
| eval "Total Bandwidth"=round(((total_bytes/1024)/1024),2), "Download"=round(((total_bytes_in/1024)/1024),2), "Upload"=round(((total_bytes_out/1024)/1024),2) 
| table dest_ip,"Total Bandwidth","Download","Upload"
| rename dest_ip as "Target IP Address"
| sort limit=10 -"Total Bandwidth"

I figure, it'd be most efficient to try and resolve the top 10 ip addresses only. Any pointers?

Cheers,
pjb2160

0 Karma

Teddles
Explorer

Hello pgj2160,

As mayurr98 has already said, try adding the following stanza to transforms.conf:

[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

Then in your search, add a lookup:

| lookup dnsLookup ip AS dest_ip OUTPUT host AS "Target URL"

That should give you what you're after, but do let us know if it's no good!

mayurr98
Super Champion
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>