All Apps and Add-ons

DNS lookups using CNAME of host entries

gudlyf
New Member

We currently have many systems with names that are meaningless to anyone other than sysadmins, but they have important CNAMEs associated with them that make much more sense to developers who use Splunk for debugging purposes.

For example, we might have a server named "saturn", which logs as such in Splunk and is quick and easy for sysadmins to use for troubleshooting. But the developers refer to it as "prod-live-db-0", which is a DNS CNAME for "saturn".

Is there a way to have Splunk do a DNS lookup on a CNAME and translate it back to the actual server name when doing a search? So if the user searches: host="prod-live-db-0" it will return all messages relevant to host="saturn" (and do this using DNS, i.e., not requiring us to statically define the values in Splunk itself)?

Tags (2)
0 Karma

pryzrak
Path Finder

To my knowledge, there isn't a way with "dnslookup". However if you click on my post below, I've done a similar task by installing the dnspython mod to the splunk python libs:

Using DNSpython mod with open Nameserver

The python example that I posted, looks up the A-record. However if you edit

rawanswer = my_resolver.query(host, 'a')

to

rawanswer = my_resolver.query(host, 'cname')

Then it should work for you. My syntax may be wrong. It may be 'cn'. But www.dnspython.org maybe able to assist on the correct syntax. If A-Record works for you then just leave it alone. v/r Pryzrak

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...