Members

Well dang — I meant to remove the line ‘| search title = OIT*’ before I saved this and I forgot. Now I can’t seem to edit it.

Just remove that line and it will work fine. On my Deployment Server all my DAs begin with ‘OIT’ so that’s why that is there.

One caveat — I don’t think the deployment info in REST was available on 5.x. I’m on 6.5.2

Thanks for sharing! I do not have a default “dnsLookup” in my environment. Did you build this with an app or acquire it from your networking team and upload it as a lookup?

If the query works the way I think it works, this is pretty neat!

Take a look at https://gosplunk.com/list-forwarders-generating-socket-errors-due-to-unkown-ssl-protocol/#comments

If you have this stanza, you should be able to use the dnslookup (and if not, you can just remove that line and references to it from the search):

[dnslookup]
external_cmd = external_lookup.py clienthost clientip
fields_list = clienthost,clientip

However, I’ve added a local version to my account and it looks like this:

[dnslookup]
disabled = 0
external_cmd = /opt/splunk/etc/apps/search/lookups/external_lookup.py host ip
fields_list = host, ip

So in my search I’m using ‘host’ and ‘ip’ instead of ‘clienthost’ and ‘clientip’

You can do that or modify my search to use ‘clienthost’ and ‘clientip’ instead.

When I do this in the search:

| lookup dnsLookup ip OUTPUT host as ForwarderInDNS

I’m passing ip in place of clientip because of my transform, and when it returns host I’m using ‘as’ to rename it.

Also, it is mentioned here in Splunk Answers:
https://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html

Thanks wrangler2x!

I have a bad paste in my first comment back to @john117, where I said “Take a look at…” The paste should have been $SPLUNK_HOME/etc/system/default/transforms.conf