Splunk Search

Splunk DNS Resolution: How to get IPs resolve to host names?

bowmanja
New Member

Hello all.

I am trying to complete something that should be easy. I wish to have IPs resolve to host names in the Splunk command.
I have read the posts and the Splunk help on this, but nothing appears to be working properly with this. Accordingly,
Can anyone provide a valid and exact step-by-step for this, and do not point to the docs?

0 Karma

woodcock
Esteemed Legend

Like this:

... | lookup dnslookup clientip as host | table host,clienthost
0 Karma

USPSSplunkSuppo
Explorer

Do you mean:

... | lookup dnslookup clientip as host | table host,clientip

0 Karma

woodcock
Esteemed Legend

No, because the lookup creates the field clienthost and furthermore, clientip does not exist (except inside of the lookup table).

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...