Splunk Search

Use Splunk for a Static Value Lookup

JeffBothel
Explorer

I have a data store that information is far faster and more reach to get to with Splunk and I am trying to figure out a way to generate information from one piece automatically from this source. In this specific example I tried the following

| inputlookup datastore
| search [setfields server_ip="10.22.10.250" | lookup dnslookup clientip as server_ip output clienthost as server_fqdn | fields server_fqdn]

But this is not rendering the information that I am looking for. The IP that I am using does have a corresponding server_fqdn value in the inputlookup datastore specified (I used a known good sample for this). I am hoping someone might be able to spot what I am not seeing in terms of syntax or value handling and offer a suggestion as to how to get this to work.

Tags (1)
0 Karma

starcher
Influencer

I'm not exactly sure what you intended. But try this as a different way

| makeresults | eval server_ip="10.22.10.250" | lookup dnslookup clients as server_ip output client_host as server_fqdn | lookup datastore server_fqdn OUTPUTNEW
0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...