Splunk Enterprise

Splunk Enterprise - Whois Query by variable not working help

pstorms
New Member

Hello,

I am a newbie to splunk and am trying to get a dashboard going to query whois and return information related to security concerns.   I am tracking on my Linux email host authorization failed messages in syslog.   I would like to take the ip address and determine, to start, where this host is located in the world based upon the asn_country_code.   If I do a query where I use just the IP address it works.  But when I try to use a variable, it fails.  I have tried searching long and hard and cannot find the answer.  When I use the addon app "Network Toolkit" it has a function whois contained, it has many attributes when an ip or domain name is provided as the search string.  One key element is rhost or asn_country_code, which I am currently interested in using.  

When I run the query:

(index=* OR index=_*) "authentication failure"
| eval country_code = [| whois 14.177.64.163 | search attribute=asn_country_code | stats values(value) as country | eval search="\"".mvjoin(country, ",")."\"" ]
| table rhost, country_code

 

I get the following results:

pstorms_0-1615417243394.png

 

This is just so it works.  I get the ip addresses of the hosts that failed their authentication request.   But the country code is manually entered and i get only the "VN" response, just troubleshooting the query so it works.   I'd like to get the appropriate country code from whois, but when I change the ip address from "14.177.64.162" to rhost, it fails the query.

(index=* OR index=_*) "authentication failure"
| eval country_code = [| whois rhost | search attribute=asn_country_code | stats values(value) as country | eval search="\"".mvjoin(country, ",")."\"" ]
| table rhost, country_code

 

I get the following:

pstorms_1-1615417369933.png

What am I doing wrong with the variable attribute rhost?   Does it need to be in quotations?  (tried) or?   I am at a loss.   Can someone guide me to the right answer?

Thank you very much.

 

 

 

 

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...