Router Syslog - IP (SRC & DST) Lookup

[jvader]

Testing Splunk by devouring the syslog from my router with Tomato firmware installed. Is there a way to have Splunk do lookups on SRC and DST ip addresses to show host/domain names vs. just the IP? (Something similar to what wallwatcher.com can do? - http://bit.ly/Q4ZZry )

Aug 23 14:25:49 192.168.1.1 Aug 23 14:26:32 kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.70 DST=74.125.130.108 LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=16424 DF PROTO=TCP SPT=53610 DPT=993 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B4010303040101080A2DCEF5B90000000004020000)
host=192.168.1.1 Options| sourcetype=syslog Options| source=udp:514

[jaysundberg]

Awesome thanks for the tips. I'll give this a shot.

[Ayn]

Yes. Splunk ships with a dynamic lookup script that does this for you. It's covered here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources
http://blogs.splunk.com/2009/12/15/reverse-dns-lookups-for-host-entries/
http://splunk-base.splunk.com/answers/8051/dns-lookup-via-splunk

Beware though that reverse lookups will probably have a significant impact on performance while searching if you have lots of different external IP's, simply because Splunk will have to resolve each and every one of them.

[Ayn]

Index-time lookups do not exist though, so implementing this at index-time will not be easily done.

[iunderwood]

Depending on how often the data needs to be searched, refreshed, or even churned through, this might be a better task to be handled during the Indexing period. This might be one of the few times it could be worthwhile to add additional metadata to the index instead or generating it at search time.