Getting Data In

How to find domain from DNS log

New Member

I am trying to compare dns log to a list of suspicions domain

my dns log look like that :

22.333.xxx.apple.com
www.apple.com
sss.ddd.apple.com
123456.a-pple.net
www.333.a-pple.net

and the domain list i want to check is
apple.com
a-pple.net

trying to do it by rex or string with no success

0 Karma
1 Solution

SplunkTrust
SplunkTrust

For regex, assuming it is in a field named "request", try

| rex field=request "(?<domain>[^\.]*\.[^\.]*)$"

Out the other end, if I didn't mess it all up because this was a pain to do on a phone, you should have a field domain that is what you want.

(EDIT: dur. First sip of coffee went in, actual answer came out.)

View solution in original post

Esteemed Legend

Have you tried the GetWatchList app?

https://splunkbase.splunk.com/app/635/

0 Karma

SplunkTrust
SplunkTrust

For regex, assuming it is in a field named "request", try

| rex field=request "(?<domain>[^\.]*\.[^\.]*)$"

Out the other end, if I didn't mess it all up because this was a pain to do on a phone, you should have a field domain that is what you want.

(EDIT: dur. First sip of coffee went in, actual answer came out.)

View solution in original post

New Member

Thanks it's working grate

0 Karma

SplunkTrust
SplunkTrust

Great!

Can you please click "Accept" so all the other people who stumble across this answer will know the answer works?

0 Karma