Splunk Dev

How do I do a reverse DNS lookup in Splunk?

daniel333
Builder

All,

I have the host name, so I am looking for the IP of that host. Not sure how to do that.

any help?
-Daniel

0 Karma

peiffer
Path Finder

There has been a lookup dnslookup in splunk for a long time now.
name to ip:

| lookup dnslookup clienthost AS host OUTPUT clientip as ip

ip to name:

| lookup dnslookup clientip AS ip OUTPUT clienthost AS host 

adonio
Ultra Champion

hello there
if you have lookup table that contains the ip and the host and the fields are: ip, host lets call it dns.csv and you have a search that capture the host
you can run the following search using the lookup command
... your search to find host ... | lookup dns.csv host OUTPUTNEW ip ...

very nice explanation here:
https://answers.splunk.com/answers/588630/understanding-the-lookup-command.html

hope it helps

0 Karma

Michael
Contributor

That's not a reverse DNS lookup, that's a table lookup.

I think the assumption (and MY question) is that you don't have a csv file...

Question not answered.

peiffer
Path Finder

Answered 4/5/2019

| lookup dnslookup clientip AS ip OUTPUT clienthost AS host

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...