nslookup TXT queries with Splunk

[urana]

I am trying to see if its possible to run nslookup -q=TXT domain 8.8.8.8 so i can compare the results of the output to an existing lookup csv file.

[manasbellani]

While it may not be possible to do TXT queries out of the box, an app has now been created for this here

This app adds a custom dnsquery command which utilizes dnspython package under the hood and allows you to do DNS queries on hostnames - tested to work for CNAME, MX, TXT, A, PTR records.

[MuS · Accepted solution]

Hi urana,

The default shipped command dnslookup does not provide this functionality. If you need a fully featured command like linux dig you would need to created a custom search command yourself. It could be as easy as creating a wrapper for dig and output thew results to Splunk 😉 See the docs for an example to write a custom search command https://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape

Hope this helps ...

cheers, MuS

[efavreau]

Do either of these help? If not, why not?
https://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html
https://answers.splunk.com/answers/8051/dns-lookup-via-splunk.html