Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- nslookup TXT queries with Splunk
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to see if its possible to run nslookup -q=TXT domain 8.8.8.8 so i can compare the results of the output to an existing lookup csv file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi urana,
The default shipped command dnslookup does not provide this functionality. If you need a fully featured command like linux dig you would need to created a custom search command yourself. It could be as easy as creating a wrapper for dig and output thew results to Splunk 😉 See the docs for an example to write a custom search command https://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
While it may not be possible to do TXT queries out of the box, an app has now been created for this here
This app adds a custom dnsquery command which utilizes dnspython package under the hood and allows you to do DNS queries on hostnames - tested to work for CNAME, MX, TXT, A, PTR records.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi urana,
The default shipped command dnslookup does not provide this functionality. If you need a fully featured command like linux dig you would need to created a custom search command yourself. It could be as easy as creating a wrapper for dig and output thew results to Splunk 😉 See the docs for an example to write a custom search command https://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do either of these help? If not, why not?
https://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html
https://answers.splunk.com/answers/8051/dns-lookup-via-splunk.html
If this reply helps you, an upvote would be appreciated.
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
