Splunk Search

Fetching out ISP , domain info for an IP address

neerajs_81
Builder

Hi All,  We are a Splunk Cloud customer having ES.   Is there a way to fetch the ISP,  domain info for an IP address directly in the splunk results ?  I have looked at this post  : https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-query-whois-by-ip/m-p/316975 but Domain Tools add on requires a paid subscription.  
Alternatively i know that we can setup a workflow to perform whois lookup via right click implementation but that is again a manual task and it ends up redirecting us to whois website.  I am looking for something open source that can fetch me the ISP and domain for an IP-address easily. 

Any thoughts or suggestions ?  Any ES users how do you accomplish this ?

Labels (1)
Tags (1)
0 Karma

joukahainen123
New Member

Check the addon ASN Lookup Generator

https://splunkbase.splunk.com/app/3531

First 

| asngen | table ip asn autonomous_system | outputlookup asn

And then 

source="yourdata" | iplocation youriptable | table youriptable, City, Country | lookup asn ip AS IPaddress

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...