Getting Data In
Highlighted

How to create a new field and assign the hostname field using IP address

Explorer

Hi All,

We are getting data from an application server for all servers and we are getting the IP address in dest_ip field. Now we like to exclude the servers from Linux and it would be difficult to use an IP address to filter the event. So we are looking for a way to perform DNSlookups and assign the hostname in the new field so that I can easily exclude it using regex. Please let me know how to create a new field and assign the hostname into it.

0 Karma
Highlighted

Re: How to create a new field and assign the hostname field using IP address

Champion
0 Karma
Highlighted

Re: How to create a new field and assign the hostname field using IP address

SplunkTrust
SplunkTrust

I believe the OP wants to do DNS lookups at index time, not search time.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to create a new field and assign the hostname field using IP address

Explorer

Yeah, I like to perform dns lookup at index time

0 Karma