All,
I have the host name, so I am looking for the IP of that host. Not sure how to do that.
any help?
-Daniel
There has been a lookup dnslookup in splunk for a long time now.
name to ip:
| lookup dnslookup clienthost AS host OUTPUT clientip as ip
ip to name:
| lookup dnslookup clientip AS ip OUTPUT clienthost AS host
hello there
if you have lookup table that contains the ip and the host and the fields are: ip, host lets call it dns.csv
and you have a search that capture the host
you can run the following search using the lookup
command
... your search to find host ... | lookup dns.csv host OUTPUTNEW ip ...
very nice explanation here:
https://answers.splunk.com/answers/588630/understanding-the-lookup-command.html
hope it helps
That's not a reverse DNS lookup, that's a table lookup.
I think the assumption (and MY question) is that you don't have a csv file...
Question not answered.
Answered 4/5/2019
| lookup dnslookup clientip AS ip OUTPUT clienthost AS host