This app complements the
dnslookup command in Splunk by adding a commands such as
dnsquery which allow the ability to perform different DNS query type such as CNAME and TXT.
Refer to detailed installation instructons for the app on Github page here.
To view logging or determine the progress made in DNS resolution for large piped input, view the logs in the
_internal index with the following command:
Example 1: Getting MX records for a domain
Run the query to get the MX records for the domain
| makeresults | eval domain="google.com" | dnsquery domainfield=domain qtype="MX"
Example 2: Getting TXT/DMARC records for a domain
To get the DMARC record for the domain
google.com which is obtained by getting
TXT for the domain
_dmarc.google.com and write the response to a new field called
dns_answer_txt, run the command:
| makeresults | eval domain="_dmarc.google.com" | dnsquery domainfield=domain qtype="TXT" answerfield="dns_answer_txt"
Example 3: Get IP address for hostnames in the lookup file
To get the IP addresses for the hostnames specified under the field
domain an inputlookup file called
domains.csv, run the command:
| inputlookup domains.csv | dnsquery domainfield=domain qtype="A"
Example 4: Get Domain name for the IP Address via PTR
Get the domain name for 22.214.171.124 IP address by specifying the ARPA address, run the search for
PTR record as per below:
| makeresults | eval domain="126.96.36.199.in-addr.arpa" | dnsquery domainfield=domain qtype="PTR"
See attached sample screenshots for more info.
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.