Can I specify a name server for DNS

[echalex]

Hi,

We are having some DNS issues in our infrastructure. Apparently the name servers our splunk hosts are using are not able to resolve some PTR queries, because of our network topology. Unfortunately, simply editing /etc/resolv.conf would also break stuff. So I need to use a different name server than the system is using by default. Is this possible?

[pryzrak]

Not sure if this post is still being reviewed. However I now have a working python script that resolves from IP to HOST and HOST to IP using an external nameserver like the open Google DNS. Look at my above post to see the answer.

[pryzrak]

I know it is possible if the dnspython module is installed. I tried it with a successful standalone script. However I'm trying to edit a renamed external_lookup.py script as something like "opendns_lookup.py". Then I edited the transforms.conf to make a new command called "opendnslookup". However I can't get "opendns_lookup.py" to work right. Look at my splunk post below on this matter and let me know what yall think:

Editing dnslookup for specific dns server

[yannK · Accepted solution]

not sure, Splunk will use a system call for the resolution, so your default DNS will be used.

[echalex]

Thanks, yannK.

That is what I suspected. Even the reverse dns lookup script will use the default configuration. Of course, I can do my own reverse lookup script in eg. perl.