Getting Data In

Host name and src_ip

itimz5
Engager

Greetings,

I am new to Splunk, but do understand most of the concepts since we use the product at work with various forwarders, etc.

I am running Splunk server on a small Mini Windows 10 system with SplunkStream enabled. I am ingesting packets via a separate dedicated NIC I have setup to receive from a smart switch using port mirroring.

I get plenty of useful data and SplunkStream is great, but I would like to somehow transform the inbound IP address to the host name. I only ever have one host name in the logs obviously for my Splunk host. Many of the logs I drill into and even the chart data shows the src_ip for all the host activity on my network.

Appreciate any information and\or assistance to make this happen if it's possible. Hopefully I am describing the situation clearly.

 

Thanks!

Labels (3)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

host.csv:

host,src_ip
AAA,X.X.X.X
BBB,Y.Y.Y.Y
....

sample:

index=yours sourcetype=stream:http
| stats count by src_ip
| lookup host.csv src_ip OUTPUT host as hostname

Something like this.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

 

View solution in original post

96nick
Communicator

This answer depends on your environment!

If you're using Splunk Stream to track network data, I'm going to assume that there are users and servers on your network and this isn't just a lab. The easiest suggestion I could offer is an automatic lookup table, but this won't work if you utilize DHCP in your network, since a lookup requires a 1->1 mapping of IP->Hostname.

In the event that it's just servers communicating to Splunk and their IPs are static, you could create an automatic lookup to bring in hostnames when those static IPs show up in your search results.

https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/DefineanautomaticlookupinSplunkWeb

 

Hope this helped!

 

0 Karma

itimz5
Engager

 I do run dhcp but my network devices are static so I’ll give it a try. 

Thanks for the info!

0 Karma

to4kawa
Ultra Champion

host.csv:

host,src_ip
AAA,X.X.X.X
BBB,Y.Y.Y.Y
....

sample:

index=yours sourcetype=stream:http
| stats count by src_ip
| lookup host.csv src_ip OUTPUT host as hostname

Something like this.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

 

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...