Splunk Search

Fetching out ISP , domain info for an IP address

neerajs_81
Builder

Hi All,  We are a Splunk Cloud customer having ES.   Is there a way to fetch the ISP,  domain info for an IP address directly in the splunk results ?  I have looked at this post  : https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-query-whois-by-ip/m-p/316975 but Domain Tools add on requires a paid subscription.  
Alternatively i know that we can setup a workflow to perform whois lookup via right click implementation but that is again a manual task and it ends up redirecting us to whois website.  I am looking for something open source that can fetch me the ISP and domain for an IP-address easily. 

Any thoughts or suggestions ?  Any ES users how do you accomplish this ?

Labels (2)
Tags (1)
0 Karma

joukahainen123
New Member

Check the addon ASN Lookup Generator

https://splunkbase.splunk.com/app/3531

First 

| asngen | table ip asn autonomous_system | outputlookup asn

And then 

source="yourdata" | iplocation youriptable | table youriptable, City, Country | lookup asn ip AS IPaddress

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...