Getting Data In

Resolving IP in other fields

I've managed to get my apache access logs into Splunk, and configured it to resolve the ip address in the client IP field. I have also captured some network traffic via wireshark and imported via .cvs file to splunk. I would like to work out how to resolve the ip address that is in the destination field.

Any help would be appreciated, as i'm new to splunk.

0 Karma

Boom got it, just added the following to props.conf

LOOKUP-rdns = dnsLookup ip AS Destination OUTPUTNEW host AS hostname

Splunk Employee
Splunk Employee

you can accept your own answer 🙂

0 Karma

I've tried adding "Destination" to C:\Program Files\Splunk\etc\system\local\transforms.conf

external_cmd = host ip Destination
fields_list = host, ip, Destination

0 Karma