Splunk Search

How to execute conditional DNS lookup in a search?

asieira
Path Finder

The problem I am trying to solve is the following: if src_hostfield is missing, null or empty, add it to events by performing DNS resolution as indicated on http://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html. However, if it is already present, don't touch it.

The simples way to do this would be if DNS resolution was available as an eval command and I could do something like eval src_host=coalesce(src_host, lookup(src_ip)). However, I was unable to find a way to do lookups outside of a search command.

Any ideas on how to achieve a similar result?

0 Karma
1 Solution

asieira
Path Finder

Turns out I found a way to do this using join. Assuming there's a macro called my_events which selects the CIM-compliant events, this is what is looks like:

`my_event` | join type=left src_ip [ search `my_event` NOT src_host="*" | fields src_ip | fields - _* | dedup src_ip | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS src_host_resolved ] | eval src_host=coalesce(src_host, src_host_resolved)

One interesting advantage is that I am doing a single DNS lookup of each unique source IP address for which there are events with no src_host field.

View solution in original post

0 Karma

dkadavis
Explorer

| makeresults
| eval src_host = split("8.8.8.8,dns.name,server_name, 172.217.9.206",",")
| mvexpand src_host
| foreach src_host [ eval tempip = if(match(src_host,"(\d{1,3}\.){3}\d{1,3}"), src_host, "") | lookup dnslookup clientip as tempip ]
| eval src_host=if(match(clienthost,"\w"),clienthost,src_host)

0 Karma

asieira
Path Finder

Turns out I found a way to do this using join. Assuming there's a macro called my_events which selects the CIM-compliant events, this is what is looks like:

`my_event` | join type=left src_ip [ search `my_event` NOT src_host="*" | fields src_ip | fields - _* | dedup src_ip | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS src_host_resolved ] | eval src_host=coalesce(src_host, src_host_resolved)

One interesting advantage is that I am doing a single DNS lookup of each unique source IP address for which there are events with no src_host field.

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...