WHOIS History API Splunk application tutorial
Whois XML History API is an application for Splunk. It allows gathering historic changes of WHOIS records for domain names within Splunk.
Prerequisites
You need to have Splunk Enterprise installed and configured. To do so, please refer to the official documentation.
Configuring the extension
1. Log in to Splunk.
2. Download and install the application. This can be done from within Splunk. (https://splunkbase.splunk.com/app/4918)
3. You can start configuring immediately once the application is installed.
3.1 You can also configure the application on the Apps page. Click on Set up next to the application name.
4. Fill in your API key and click on Save.
Using the extension
1. On the WHOIS lookup page you can perform instant WHOIS lookups. Select visible fields and submit the form.
2. To integrate WHOIS History lookup into your script you can use the command wxawhoishistory. It takes 3 arguments: domain_name, where you provide the domain name, api_key (optional), where you can provide your API key, otherwise it will be taken from a config file, and fields (optional), which takes a comma-separated list of fields you expect to see. A full list of fields can be found on the WHOIS lookup page. You can try it on the Search page.
