Splunk Search

Display IP address and hostname from DNS Search arpa data

landen99
Motivator

Searches of DNS logs, sourcetype=dns, reveal records with information of the form *.in-addr.arpa
While I can reverse the ip address in that form for each result and do the nslookup for each event separately, such a task is fairly time consuming.
Is there a way to get splunk to show the ip address and domain name for each *.in-addr.arpa in a table? It would look something like this:

sourcetype=dns | table _time domain domain_ip domain_name

which would give something like the following in my table:
2014-03-17 07:54:00 xx.yy.zz.aa.in-addr.arpa aa.zz.yy.xx siteofinterest.com

0 Karma
1 Solution

dturner83
Path Finder

Have you tried this?
https://apps.splunk.com/app/1535/

Works well for us, but sometimes the dns lookups for whatever reason can take quite a while depending on the dataset.

View solution in original post

dturner83
Path Finder

Have you tried this?
https://apps.splunk.com/app/1535/

Works well for us, but sometimes the dns lookups for whatever reason can take quite a while depending on the dataset.

landen99
Motivator

Update: It seems that we are trying to avoid having Splunk do any processing. We want Splunk to focus on data indexing and retrieval. With that in mind, I am wondering if there is a way to retrieve the results in a format which lends itself to processing in another application or with a batch file. If I can create a batch file with the correct commands and information, and I can execute that file outside of Splunk at my leisure. I am not sure how I could get Splunk to export the information with the appropriate format and commands into a batch file. Is there another way?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...