Monitoring Splunk

Why Splunk external_lookup.py is not able to resolve external DNS IP

MousumiChowdhur
Contributor

Hi,

I am using external_lookup.py in Splunk to resolve the IPs/hostnames and get the respective hostnames/IPs. I could see that the python script is only able to resolve the internal IPs/hostnames but not external IPs/hostnames like www.google.com or so. I am assuming that because of the proxy it's not able to resolve the external IPs/hostnames. If anyone has tried this before, can you please guide me how can I achieve that?

Thank you!

0 Karma
1 Solution

MousumiChowdhur
Contributor

Hi,

After spending some time on troubleshooting, I found that the name server that is there for my Search heads can only resolve internal IPs/Hostnames. Resolving external IPs/Hostnames is out of scope for the name server.

Thank you.

View solution in original post

0 Karma

MousumiChowdhur
Contributor

Hi,

After spending some time on troubleshooting, I found that the name server that is there for my Search heads can only resolve internal IPs/Hostnames. Resolving external IPs/Hostnames is out of scope for the name server.

Thank you.

0 Karma

woodcock
Esteemed Legend

Are you using it like this?

| makeresults | eval clienthost = "google.com"
| lookup dnslookup clienthost

This should generate an output field called clientip

0 Karma

MousumiChowdhur
Contributor

Hi @woodcock ,

Ya I could get an output field clientip for the internal host names but not external host names. Later just found that resolving any external host names is out of scope for the available name server.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @MousumiChowdhury,

If you look at external_lookup.py script, it uses python socket module which interacts with OS name resolution (DNS) server, if DNS server which is configured in OS (On which splunk is running) is blocking any external name resolution then you can't resolve external IP/hostnames with external_lookup.py script and you might need to create your own script which use proxy IP for name resolution on external DNS servers but I am not expert on this so can't help much more here.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...