Searching results after dnslookup

[adamschmitz]

I'm trying to figure out a way to search/report on syslog data by machine name when the original input is IP only.

Example:
Feb 4 08:41:11 10.5.3.62 2016- 2- 4 14:41:14 event XYZ happened on ip 10.5.12.231.

I do a dnslookup to convert the IP to the name. Since our naming convention tells me what OS the computer has I want to be able to search on the machine name to filter by OS type. This way I can see event XYZ happened on these 14 Macs or these 5 Windows machines and create dashboards based on that information.

I tried subsearches but that didn't seem to get me anywhere.

Thanks.

[javiergn]

Hi,

I can think of two options at least:

1. External lookup
Perform a DNS lookup via script. See this.

PROS: quick and easy to configure
CONS: slow

2. DB or CSV lookup
Write a script to dump all your internal DNS records into a CSV file or SQL database
Then configure a file or database lookup.
Keep in mind CSV is natively supported whereas DB is not and you need an app.

PROS: good performance
CONS: requires some maintenance and might not be fully real-time

Hope that helps.