Reverse DNS API Splunk application tutorial
Reverse DNS API is an application for Splunk. It lets you search for existing domains by their DNS record values.
Prerequisites
You need to have Splunk Enterprise installed and configured. To do so, please refer to the official documentation.
Configuring the extension
1. Log in to Splunk.
2. Download and install the application. This can be done from within Splunk. (https://splunkbase.splunk.com/app/6291)
3. You can start configuring immediately once the application is installed.
3.1 You can also configure the application on the Apps page. Click on Set up next to the application name.
4. Fill in your API key and click on Save.
Using the extension
1. On the Reverse DNS lookup page you can perform instant Reverse DNS lookups.
2. To integrate Reverse DNS into your script you can use the wxareversednsapi command. It takes up to 14 arguments: term1-term4, where you can provide search terms with wildcard support, field1-field4 (domain/value) which set either domain name or DNS record value search context for corresponding terms, exclude1-exclude4 (optional, 0/1, 0 by default) to exclude matching records from results, record_type (cname/soa/txt) applied to all terms and api_key (optional) taken from config if not specified.
