I'm trying to figure out a way to search/report on syslog data by machine name when the original input is IP only.
Feb 4 08:41:11 10.5.3.62 2016- 2- 4 14:41:14 event XYZ happened on ip 10.5.12.231.
I do a dnslookup to convert the IP to the name. Since our naming convention tells me what OS the computer has I want to be able to search on the machine name to filter by OS type. This way I can see event XYZ happened on these 14 Macs or these 5 Windows machines and create dashboards based on that information.
I tried subsearches but that didn't seem to get me anywhere.
1. External lookup
Perform a DNS lookup via script. See this.
PROS: quick and easy to configure
2. DB or CSV lookup
Write a script to dump all your internal DNS records into a CSV file or SQL database
Then configure a file or database lookup.
Keep in mind CSV is natively supported whereas DB is not and you need an app.
PROS: good performance
CONS: requires some maintenance and might not be fully real-time