Splunk Search

If Reverse DNS lookup fails, then results don't get displayed - not what I intended!

myeatman
Engager

I'm trying to report on successful login activity to S/FTP server via the following:

host="my-ftp-server" sc_status="250" OR sc_status="331" | lookup dnslookup clientip as c_ip output clienthost as hostname | top cs_username,c_ip,hostname,sc_status limit="1000"

Problem: if the dnslookup fails, then Splunk does not include in the results. In other words, for the above query, if "hostname" is null, then the result isn't included in the displayed results - how do I tell splunk to include these? I don't want to exclude just because the dns lookup failed. It seems to display just fine for logins coming from hosts for which I can do a successful nslookup from my splunk box.

Anyone run across this problem or have any ideas?

Tags (2)

timdenholm
Engager

I had a similar use case to this, however I wanted to only use one field for both the client IP address and resolved hostname. I used eval with if and isnull to substitute the null values with the original client IP address value so that it's retained. Using fillnull as is commonly suggested would only substitute the null values with a predefined string.

`some kind of search`
| lookup dnslookup clientip as c_ip output clienthost as host_resolved
| eval hostname = if(isnull(host_resolved), host, host_resolved)
| stats count by hostname, user
0 Karma

myeatman
Engager

fillnull is my friend:

host="my-ftp-server" sc_status="250" OR sc_status="331" | lookup dnslookup clientip as c_ip output clienthost as hostname | fillnull value="No DNS Info" | top cs_username,c_ip,hostname,sc_status limit="1000"

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...