Splunk Search

Searching results after dnslookup

adamschmitz
Path Finder

I'm trying to figure out a way to search/report on syslog data by machine name when the original input is IP only.

Example:
Feb 4 08:41:11 10.5.3.62 2016- 2- 4 14:41:14 event XYZ happened on ip 10.5.12.231.

I do a dnslookup to convert the IP to the name. Since our naming convention tells me what OS the computer has I want to be able to search on the machine name to filter by OS type. This way I can see event XYZ happened on these 14 Macs or these 5 Windows machines and create dashboards based on that information.

I tried subsearches but that didn't seem to get me anywhere.

Thanks.

Tags (2)
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

I can think of two options at least:

1. External lookup
Perform a DNS lookup via script. See this.

PROS: quick and easy to configure
CONS: slow

2. DB or CSV lookup
Write a script to dump all your internal DNS records into a CSV file or SQL database
Then configure a file or database lookup.
Keep in mind CSV is natively supported whereas DB is not and you need an app.

PROS: good performance
CONS: requires some maintenance and might not be fully real-time

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...