Splunk Search

Searching results after dnslookup

adamschmitz
Path Finder

I'm trying to figure out a way to search/report on syslog data by machine name when the original input is IP only.

Example:
Feb 4 08:41:11 10.5.3.62 2016- 2- 4 14:41:14 event XYZ happened on ip 10.5.12.231.

I do a dnslookup to convert the IP to the name. Since our naming convention tells me what OS the computer has I want to be able to search on the machine name to filter by OS type. This way I can see event XYZ happened on these 14 Macs or these 5 Windows machines and create dashboards based on that information.

I tried subsearches but that didn't seem to get me anywhere.

Thanks.

Tags (2)
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

I can think of two options at least:

1. External lookup
Perform a DNS lookup via script. See this.

PROS: quick and easy to configure
CONS: slow

2. DB or CSV lookup
Write a script to dump all your internal DNS records into a CSV file or SQL database
Then configure a file or database lookup.
Keep in mind CSV is natively supported whereas DB is not and you need an app.

PROS: good performance
CONS: requires some maintenance and might not be fully real-time

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...