Splunk Search

Resolve IP to Host

lain179
Communicator

I am creating a failed login report from WMI security log entires. My temporary search command looks like:

sourcetype="WMI*Security" Type="Audit Failure" Account_Name=* | stats values(Account_Name) values(Client_Address) values(Client_Port) by _time

Client_Address values are IP addresses, and I would like them to be displayed as the host name. How can I accomplish that?

FYI, I have already read the article on Lookup command to resolve IP to Host.
http://docs.splunk.com/Documentation/Splunk/4.2.2/Knowledge/Addfieldsfromexternaldatasources

And I am having trouble understanding how to set it up and make use of it in my search. Really appreciate any help.

Thanks!

Tags (1)
0 Karma
1 Solution

emechler_splunk
Splunk Employee
Splunk Employee

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Example...

If the docs are unclear or need to be improved, don't hesitate to submit feedback at the bottom of each docs page! In the meantime, maybe this will add some clarity to this process:

You want to add this stanza to $SPLUNK_HOME/etc/system/local/transforms.conf:

[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

This defines the lookup called "dnsLookup" which we can now tie to a specific sourcetype in $SPLUNK_HOME/etc/system/local/props.conf as such:

[WMI*Security]
LOOKUP-rdns = dnsLookup ip AS Client_Address

Note that this stanza has been renamed from the docs to reference the sourcetype you're interested in performing the lookup on (WMI*Security) and will create a new field called hostname that contains the rdns lookup value.

Restart Splunk and you should be all set.

View solution in original post

Michael
Contributor

Does the target need to be an existing extraction?

For example:
LOOKUP-rdns = dnsLookup ip AS Client_Address

Does "Client_Address" have to be an existing field that's extracted (and presumably populated with IP addresses) -- or is this a new field that is created?

(in either case, still not getting this to work...)
/opt/splunk/etc/system/local/transforms.conf
[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

/opt/splunk/etc/system/local/props.conf
[access_log-too_small]
LOOKUP-rdns = dnsLookup ip AS Client_Address

Also tried "source_ip" (v.s. Client_Address) because it's an existing extraction that's populated with IP addresses, yes appearing as the sourcetype "access_log-too_small".

0 Karma

emechler_splunk
Splunk Employee
Splunk Employee

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Example...

If the docs are unclear or need to be improved, don't hesitate to submit feedback at the bottom of each docs page! In the meantime, maybe this will add some clarity to this process:

You want to add this stanza to $SPLUNK_HOME/etc/system/local/transforms.conf:

[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

This defines the lookup called "dnsLookup" which we can now tie to a specific sourcetype in $SPLUNK_HOME/etc/system/local/props.conf as such:

[WMI*Security]
LOOKUP-rdns = dnsLookup ip AS Client_Address

Note that this stanza has been renamed from the docs to reference the sourcetype you're interested in performing the lookup on (WMI*Security) and will create a new field called hostname that contains the rdns lookup value.

Restart Splunk and you should be all set.

emechler_splunk
Splunk Employee
Splunk Employee

Edited the original post to remove the "OUTPUTNEW host AS hostname" part of the lookup; that doesn't appear to be necessary anymore. You also don't need to add "| lookup dnsLookup Client_Address" to your search; the entry in props.conf makes the lookup automatic.

0 Karma

lain179
Communicator

Never, I got it to work with file lookup.

0 Karma

lain179
Communicator

I did that, and what's next? How do I use that in my search to transform IP to host name? When I do "lookup dnsLoopup Client_Address", it gave me an error saying 'dnsLookup' does not exist.


sourcetype="WMI*Security" Type="Audit Failure" Account_Name=* | stats values(Account_Name) values(Client_Address) values(Client_Port) by _time | lookup dnsLookup Client_Address

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...