Splunk Search

Fetching out ISP , domain info for an IP address

neerajs_81
Builder

Hi All,  We are a Splunk Cloud customer having ES.   Is there a way to fetch the ISP,  domain info for an IP address directly in the splunk results ?  I have looked at this post  : https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-query-whois-by-ip/m-p/316975 but Domain Tools add on requires a paid subscription.  
Alternatively i know that we can setup a workflow to perform whois lookup via right click implementation but that is again a manual task and it ends up redirecting us to whois website.  I am looking for something open source that can fetch me the ISP and domain for an IP-address easily. 

Any thoughts or suggestions ?  Any ES users how do you accomplish this ?

Labels (1)
Tags (1)
0 Karma

joukahainen123
New Member

Check the addon ASN Lookup Generator

https://splunkbase.splunk.com/app/3531

First 

| asngen | table ip asn autonomous_system | outputlookup asn

And then 

source="yourdata" | iplocation youriptable | table youriptable, City, Country | lookup asn ip AS IPaddress

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...