- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: nslookup TXT queries with Splunk
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to see if its possible to run nslookup -q=TXT domain 8.8.8.8 so i can compare the results of the output to an existing lookup csv file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi urana,
The default shipped command dnslookup does not provide this functionality. If you need a fully featured command like linux dig you would need to created a custom search command yourself. It could be as easy as creating a wrapper for dig and output thew results to Splunk 😉 See the docs for an example to write a custom search command https://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
While it may not be possible to do TXT queries out of the box, an app has now been created for this here
This app adds a custom dnsquery command which utilizes dnspython package under the hood and allows you to do DNS queries on hostnames - tested to work for CNAME, MX, TXT, A, PTR records.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi urana,
The default shipped command dnslookup does not provide this functionality. If you need a fully featured command like linux dig you would need to created a custom search command yourself. It could be as easy as creating a wrapper for dig and output thew results to Splunk 😉 See the docs for an example to write a custom search command https://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do either of these help? If not, why not?
https://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html
https://answers.splunk.com/answers/8051/dns-lookup-via-splunk.html
If this reply helps you, an upvote would be appreciated.
Detecting Remote Code Executions With the Splunk Threat Research Team
Observability | Use Synthetic Monitoring for Website Metadata Verification
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
