Hi All, We are a Splunk Cloud customer having ES. Is there a way to fetch the ISP, domain info for an IP address directly in the splunk results ? I have looked at this post : https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-query-whois-by-ip/m-p/316975 but Domain Tools add on requires a paid subscription.
Alternatively i know that we can setup a workflow to perform whois lookup via right click implementation but that is again a manual task and it ends up redirecting us to whois website. I am looking for something open source that can fetch me the ISP and domain for an IP-address easily.
Any thoughts or suggestions ? Any ES users how do you accomplish this ?
Check the addon ASN Lookup Generator
https://splunkbase.splunk.com/app/3531
First
| asngen | table ip asn autonomous_system | outputlookup asn
And then
source="yourdata" | iplocation youriptable | table youriptable, City, Country | lookup asn ip AS IPaddress