Getting Data In

Resolving IP in other fields

adriangoodhead7
Explorer

I've managed to get my apache access logs into Splunk, and configured it to resolve the ip address in the client IP field. I have also captured some network traffic via wireshark and imported via .cvs file to splunk. I would like to work out how to resolve the ip address that is in the destination field.

Any help would be appreciated, as i'm new to splunk.

0 Karma

adriangoodhead7
Explorer

Boom got it, just added the following to props.conf

[csv]
LOOKUP-rdns = dnsLookup ip AS Destination OUTPUTNEW host AS hostname

yannK
Splunk Employee
Splunk Employee

you can accept your own answer 🙂

0 Karma

adriangoodhead7
Explorer

I've tried adding "Destination" to C:\Program Files\Splunk\etc\system\local\transforms.conf

dnsLookup]
external_cmd = external_lookup.py host ip Destination
fields_list = host, ip, Destination

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...