Convert IP address into hostname

[sympatiko]

Hi,

Is there a way on search query to resolve any IP result into hostname?

Thanks

[martin_mueller]

No app needed, Splunk comes with a DNS lookup out of the box:

some search returning a field called ip | lookup dnslookup clientip as ip OUTPUT clienthost as your_shiny_host_field

[woodcock]

You need the dnslookup app:

https://splunkbase.splunk.com/app/1535/

[sympatiko]

Hi Im getting an "Unknown search command 'dnslookup'

[woodcock]

Did you install the app on your Search Head? That is all I did and it worked great. It isn't my app so I would read through the app documentation and make sure that you have all prerequisites and see if there are any notes that will help you.