Splunk Search

nslookup TXT queries with Splunk

urana
Engager

I am trying to see if its possible to run nslookup -q=TXT domain 8.8.8.8 so i can compare the results of the output to an existing lookup csv file.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi urana,

The default shipped command dnslookup does not provide this functionality. If you need a fully featured command like linux dig you would need to created a custom search command yourself. It could be as easy as creating a wrapper for dig and output thew results to Splunk 😉 See the docs for an example to write a custom search command https://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

manasbellani
Explorer

While it may not be possible to do TXT queries out of the box, an app has now been created for this here

This app adds a custom dnsquery command which utilizes dnspython package under the hood and allows you to do DNS queries on hostnames - tested to work for CNAME, MX, TXT, A, PTR records.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi urana,

The default shipped command dnslookup does not provide this functionality. If you need a fully featured command like linux dig you would need to created a custom search command yourself. It could be as easy as creating a wrapper for dig and output thew results to Splunk 😉 See the docs for an example to write a custom search command https://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape

Hope this helps ...

cheers, MuS

0 Karma

efavreau
Motivator

Do either of these help? If not, why not?
https://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html
https://answers.splunk.com/answers/8051/dns-lookup-via-splunk.html

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...