Host name and src_ip

[itimz5]

Greetings,

I am new to Splunk, but do understand most of the concepts since we use the product at work with various forwarders, etc.

I am running Splunk server on a small Mini Windows 10 system with SplunkStream enabled. I am ingesting packets via a separate dedicated NIC I have setup to receive from a smart switch using port mirroring.

I get plenty of useful data and SplunkStream is great, but I would like to somehow transform the inbound IP address to the host name. I only ever have one host name in the logs obviously for my Splunk host. Many of the logs I drill into and even the chart data shows the src_ip for all the host activity on my network.

Appreciate any information and\or assistance to make this happen if it's possible. Hopefully I am describing the situation clearly.

Thanks!

[96nick]

This answer depends on your environment!

If you're using Splunk Stream to track network data, I'm going to assume that there are users and servers on your network and this isn't just a lab. The easiest suggestion I could offer is an automatic lookup table, but this won't work if you utilize DHCP in your network, since a lookup requires a 1->1 mapping of IP->Hostname.

In the event that it's just servers communicating to Splunk and their IPs are static, you could create an automatic lookup to bring in hostnames when those static IPs show up in your search results.

https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/DefineanautomaticlookupinSplunkWeb

Hope this helped!

[itimz5]

 I do run dhcp but my network devices are static so I’ll give it a try. 

Thanks for the info!

[to4kawa · Accepted solution]

host.csv:

host,src_ip
AAA,X.X.X.X
BBB,Y.Y.Y.Y
....

sample:

index=yours sourcetype=stream:http
| stats count by src_ip
| lookup host.csv src_ip OUTPUT host as hostname

Something like this.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup