Splunk Search

Resolve IP to Host

lain179
Communicator

I am creating a failed login report from WMI security log entires. My temporary search command looks like:

sourcetype="WMI*Security" Type="Audit Failure" Account_Name=* | stats values(Account_Name) values(Client_Address) values(Client_Port) by _time

Client_Address values are IP addresses, and I would like them to be displayed as the host name. How can I accomplish that?

FYI, I have already read the article on Lookup command to resolve IP to Host.
http://docs.splunk.com/Documentation/Splunk/4.2.2/Knowledge/Addfieldsfromexternaldatasources

And I am having trouble understanding how to set it up and make use of it in my search. Really appreciate any help.

Thanks!

Tags (1)
0 Karma
1 Solution

emechler_splunk
Splunk Employee
Splunk Employee

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Example...

If the docs are unclear or need to be improved, don't hesitate to submit feedback at the bottom of each docs page! In the meantime, maybe this will add some clarity to this process:

You want to add this stanza to $SPLUNK_HOME/etc/system/local/transforms.conf:

[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

This defines the lookup called "dnsLookup" which we can now tie to a specific sourcetype in $SPLUNK_HOME/etc/system/local/props.conf as such:

[WMI*Security]
LOOKUP-rdns = dnsLookup ip AS Client_Address

Note that this stanza has been renamed from the docs to reference the sourcetype you're interested in performing the lookup on (WMI*Security) and will create a new field called hostname that contains the rdns lookup value.

Restart Splunk and you should be all set.

View solution in original post

Michael
Contributor

Does the target need to be an existing extraction?

For example:
LOOKUP-rdns = dnsLookup ip AS Client_Address

Does "Client_Address" have to be an existing field that's extracted (and presumably populated with IP addresses) -- or is this a new field that is created?

(in either case, still not getting this to work...)
/opt/splunk/etc/system/local/transforms.conf
[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

/opt/splunk/etc/system/local/props.conf
[access_log-too_small]
LOOKUP-rdns = dnsLookup ip AS Client_Address

Also tried "source_ip" (v.s. Client_Address) because it's an existing extraction that's populated with IP addresses, yes appearing as the sourcetype "access_log-too_small".

0 Karma

emechler_splunk
Splunk Employee
Splunk Employee

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Example...

If the docs are unclear or need to be improved, don't hesitate to submit feedback at the bottom of each docs page! In the meantime, maybe this will add some clarity to this process:

You want to add this stanza to $SPLUNK_HOME/etc/system/local/transforms.conf:

[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

This defines the lookup called "dnsLookup" which we can now tie to a specific sourcetype in $SPLUNK_HOME/etc/system/local/props.conf as such:

[WMI*Security]
LOOKUP-rdns = dnsLookup ip AS Client_Address

Note that this stanza has been renamed from the docs to reference the sourcetype you're interested in performing the lookup on (WMI*Security) and will create a new field called hostname that contains the rdns lookup value.

Restart Splunk and you should be all set.

emechler_splunk
Splunk Employee
Splunk Employee

Edited the original post to remove the "OUTPUTNEW host AS hostname" part of the lookup; that doesn't appear to be necessary anymore. You also don't need to add "| lookup dnsLookup Client_Address" to your search; the entry in props.conf makes the lookup automatic.

0 Karma

lain179
Communicator

Never, I got it to work with file lookup.

0 Karma

lain179
Communicator

I did that, and what's next? How do I use that in my search to transform IP to host name? When I do "lookup dnsLoopup Client_Address", it gave me an error saying 'dnsLookup' does not exist.


sourcetype="WMI*Security" Type="Audit Failure" Account_Name=* | stats values(Account_Name) values(Client_Address) values(Client_Port) by _time | lookup dnsLookup Client_Address

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...