Learn How We Can Help You Keep Teleworkers Protected During the COVID-19 Crisis

Reporting

Reply
Highlighted

Getting hostname for IPs in a report

Adviser
Posts: 82
2343     2

I had the request to get the hostname for IPs in a report. 

 

Here is an example with the Top IP report from an IP to a hostname

 

Before:

Capture d’écran 2017-02-23 à 10.25.02.png

 

index=ib_dns_summary report=si_dns_top_clients                                        

| stats sum(COUNT) as CLIENT_QUERIES by CLIENT                                      

| sort -CLIENT_QUERIES                                        

| head 10                  

| rename CLIENT_QUERIES as "CLIENT QUERIES"

 

 

After:

index=ib_dns_summary report=si_dns_top_clients

| stats sum(COUNT) as CLIENT_QUERIES by CLIENT              

| sort -CLIENT_QUERIES

| head 10

 

| lookup dnslookup clientip AS CLIENT

| fillnull value="unknown" clienthost
| eval CLIENT = CLIENT." / ".clienthost

| fields CLIENT, "CLIENT QUERIES"

 

Capture d’écran 2017-02-23 à 10.29.08.png

Check out our new Tech docs website at http://docs.infobox.com for latest documentation on Infoblox products.
Showing results for 
Search instead for 
Do you mean 

Recommended for You