Splunk Search

How to execute conditional DNS lookup in a search?

Path Finder

The problem I am trying to solve is the following: if src_hostfield is missing, null or empty, add it to events by performing DNS resolution as indicated on http://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html. However, if it is already present, don't touch it.

The simples way to do this would be if DNS resolution was available as an eval command and I could do something like eval src_host=coalesce(src_host, lookup(src_ip)). However, I was unable to find a way to do lookups outside of a search command.

Any ideas on how to achieve a similar result?

0 Karma
1 Solution

Path Finder

Turns out I found a way to do this using join. Assuming there's a macro called my_events which selects the CIM-compliant events, this is what is looks like:

`my_event` | join type=left src_ip [ search `my_event` NOT src_host="*" | fields src_ip | fields - _* | dedup src_ip | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS src_host_resolved ] | eval src_host=coalesce(src_host, src_host_resolved)

One interesting advantage is that I am doing a single DNS lookup of each unique source IP address for which there are events with no src_host field.

View solution in original post

0 Karma

Path Finder

Turns out I found a way to do this using join. Assuming there's a macro called my_events which selects the CIM-compliant events, this is what is looks like:

`my_event` | join type=left src_ip [ search `my_event` NOT src_host="*" | fields src_ip | fields - _* | dedup src_ip | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS src_host_resolved ] | eval src_host=coalesce(src_host, src_host_resolved)

One interesting advantage is that I am doing a single DNS lookup of each unique source IP address for which there are events with no src_host field.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!