Splunk Search

Display IP address and hostname from DNS Search arpa data

landen99
Motivator

Searches of DNS logs, sourcetype=dns, reveal records with information of the form *.in-addr.arpa
While I can reverse the ip address in that form for each result and do the nslookup for each event separately, such a task is fairly time consuming.
Is there a way to get splunk to show the ip address and domain name for each *.in-addr.arpa in a table? It would look something like this:

sourcetype=dns | table _time domain domain_ip domain_name

which would give something like the following in my table:
2014-03-17 07:54:00 xx.yy.zz.aa.in-addr.arpa aa.zz.yy.xx siteofinterest.com

0 Karma
1 Solution

dturner83
Path Finder

Have you tried this?
https://apps.splunk.com/app/1535/

Works well for us, but sometimes the dns lookups for whatever reason can take quite a while depending on the dataset.

View solution in original post

dturner83
Path Finder

Have you tried this?
https://apps.splunk.com/app/1535/

Works well for us, but sometimes the dns lookups for whatever reason can take quite a while depending on the dataset.

landen99
Motivator

Update: It seems that we are trying to avoid having Splunk do any processing. We want Splunk to focus on data indexing and retrieval. With that in mind, I am wondering if there is a way to retrieve the results in a format which lends itself to processing in another application or with a batch file. If I can create a batch file with the correct commands and information, and I can execute that file outside of Splunk at my leisure. I am not sure how I could get Splunk to export the information with the appropriate format and commands into a batch file. Is there another way?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...