Splunk Search

Fetching out ISP , domain info for an IP address

neerajs_81
Builder

Hi All,  We are a Splunk Cloud customer having ES.   Is there a way to fetch the ISP,  domain info for an IP address directly in the splunk results ?  I have looked at this post  : https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-query-whois-by-ip/m-p/316975 but Domain Tools add on requires a paid subscription.  
Alternatively i know that we can setup a workflow to perform whois lookup via right click implementation but that is again a manual task and it ends up redirecting us to whois website.  I am looking for something open source that can fetch me the ISP and domain for an IP-address easily. 

Any thoughts or suggestions ?  Any ES users how do you accomplish this ?

Labels (1)
Tags (1)
0 Karma

joukahainen123
New Member

Check the addon ASN Lookup Generator

https://splunkbase.splunk.com/app/3531

First 

| asngen | table ip asn autonomous_system | outputlookup asn

And then 

source="yourdata" | iplocation youriptable | table youriptable, City, Country | lookup asn ip AS IPaddress

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...