Splunk Search

Convert IP address into hostname

sympatiko
Communicator

Hi,

Is there a way on search query to resolve any IP result into hostname?

Thanks

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

No app needed, Splunk comes with a DNS lookup out of the box:

some search returning a field called ip | lookup dnslookup clientip as ip OUTPUT clienthost as your_shiny_host_field

woodcock
Esteemed Legend

You need the dnslookup app:

https://splunkbase.splunk.com/app/1535/

0 Karma

sympatiko
Communicator

Hi Im getting an "Unknown search command 'dnslookup'

0 Karma

woodcock
Esteemed Legend

Did you install the app on your Search Head? That is all I did and it worked great. It isn't my app so I would read through the app documentation and make sure that you have all prerequisites and see if there are any notes that will help you.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...