Splunk Search

Fetching out ISP , domain info for an IP address

neerajs_81
Builder

Hi All,  We are a Splunk Cloud customer having ES.   Is there a way to fetch the ISP,  domain info for an IP address directly in the splunk results ?  I have looked at this post  : https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-query-whois-by-ip/m-p/316975 but Domain Tools add on requires a paid subscription.  
Alternatively i know that we can setup a workflow to perform whois lookup via right click implementation but that is again a manual task and it ends up redirecting us to whois website.  I am looking for something open source that can fetch me the ISP and domain for an IP-address easily. 

Any thoughts or suggestions ?  Any ES users how do you accomplish this ?

Labels (1)
Tags (1)
0 Karma

joukahainen123
New Member

Check the addon ASN Lookup Generator

https://splunkbase.splunk.com/app/3531

First 

| asngen | table ip asn autonomous_system | outputlookup asn

And then 

source="yourdata" | iplocation youriptable | table youriptable, City, Country | lookup asn ip AS IPaddress

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...