Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow the steps in this recipe to look up hostnames for given IP addresses:

1. On your Splunk server, create a new transforms.conf file at $SPLUNK_HOME/etc/apps/operational_intelligence/local/transforms.conf. If one already exists, then you can just edit the existing file.
2. Add the following text to the file and save it:

[dnsLookup] 
external_cmd = external_lookup.py clienthost clientip 
fields_list = clienthost, clientip 

3. Return to the Splunk web interface and select the Operational Intelligence application.
4. In the search bar, enter the following search:

index=main sourcetype="access_combined" | lookup dnslookup  clientip

5. Hit your Enter key and the search should start; wait for some results to show.
6. You should now see a ...