Splunk Search

Convert IP address into hostname

sympatiko
Communicator

Hi,

Is there a way on search query to resolve any IP result into hostname?

Thanks

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

No app needed, Splunk comes with a DNS lookup out of the box:

some search returning a field called ip | lookup dnslookup clientip as ip OUTPUT clienthost as your_shiny_host_field

woodcock
Esteemed Legend

You need the dnslookup app:

https://splunkbase.splunk.com/app/1535/

0 Karma

sympatiko
Communicator

Hi Im getting an "Unknown search command 'dnslookup'

0 Karma

woodcock
Esteemed Legend

Did you install the app on your Search Head? That is all I did and it worked great. It isn't my app so I would read through the app documentation and make sure that you have all prerequisites and see if there are any notes that will help you.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...