Splunk Search

Convert IP address into hostname

sympatiko
Communicator

Hi,

Is there a way on search query to resolve any IP result into hostname?

Thanks

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

No app needed, Splunk comes with a DNS lookup out of the box:

some search returning a field called ip | lookup dnslookup clientip as ip OUTPUT clienthost as your_shiny_host_field

woodcock
Esteemed Legend

You need the dnslookup app:

https://splunkbase.splunk.com/app/1535/

0 Karma

sympatiko
Communicator

Hi Im getting an "Unknown search command 'dnslookup'

0 Karma

woodcock
Esteemed Legend

Did you install the app on your Search Head? That is all I did and it worked great. It isn't my app so I would read through the app documentation and make sure that you have all prerequisites and see if there are any notes that will help you.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!