I've managed to get my apache access logs into Splunk, and configured it to resolve the ip address in the client IP field. I have also captured some network traffic via wireshark and imported via .cvs file to splunk. I would like to work out how to resolve the ip address that is in the destination field.
Any help would be appreciated, as i'm new to splunk.
Boom got it, just added the following to props.conf
[csv]
LOOKUP-rdns = dnsLookup ip AS Destination OUTPUTNEW host AS hostname
you can accept your own answer 🙂
I've tried adding "Destination" to C:\Program Files\Splunk\etc\system\local\transforms.conf
dnsLookup]
external_cmd = external_lookup.py host ip Destination
fields_list = host, ip, Destination