All Apps and Add-ons

Using |lookup whois on domain name

skyelowryvancit
Explorer

I have a lookup table ipn1.csv
src_ip,hostname
54.69.58.243,splunk.com
172.217.14.206,google.com

When I run:

   | inputlookup "ipn1.csv"
  | lookup whois host as src_ip

(lookup whois information based on the IP address) I get information populated from the whois search

When I run:

| inputlookup "ipn1.csv"
 | lookup whois host as hostname

(lookup whois information based on the domain name) no information is populated.

In my use case, I want to take a domain name from a search and lookup the creation_date but I cannot seem to get results.

When doing

|whois splunk.com 

it works perfectly, just not within a runtime search.

0 Karma

Prewin027
Explorer

Hi,
From your question i understand that, you want to take domain name from your search and compare the same with a lookup table to fetch creation date.

For this,

|inputlookup "ipn1.csv" |fields hostname |rename hostname as host| lookup whois host OUTPUT creation_date

0 Karma

skyelowryvancit
Explorer

I was only using the table to illustrate my problem.

My issue is that whois query will work when called by |lookup whois using the IP address, but not the Hostname.

Hostname only works when using |whois and not |lookup whois

0 Karma

robert_miller
Path Finder

Hey @skyelowryvancity , I can't get that lookup command to work. What version of the app are you using?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...