Splunk Search

Searching results after dnslookup

adamschmitz
Path Finder

I'm trying to figure out a way to search/report on syslog data by machine name when the original input is IP only.

Example:
Feb 4 08:41:11 10.5.3.62 2016- 2- 4 14:41:14 event XYZ happened on ip 10.5.12.231.

I do a dnslookup to convert the IP to the name. Since our naming convention tells me what OS the computer has I want to be able to search on the machine name to filter by OS type. This way I can see event XYZ happened on these 14 Macs or these 5 Windows machines and create dashboards based on that information.

I tried subsearches but that didn't seem to get me anywhere.

Thanks.

Tags (2)
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

I can think of two options at least:

1. External lookup
Perform a DNS lookup via script. See this.

PROS: quick and easy to configure
CONS: slow

2. DB or CSV lookup
Write a script to dump all your internal DNS records into a CSV file or SQL database
Then configure a file or database lookup.
Keep in mind CSV is natively supported whereas DB is not and you need an app.

PROS: good performance
CONS: requires some maintenance and might not be fully real-time

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...