Domains & Subdomains Discovery API Splunk application tutorial
Whois XML Domains & Subdomains Discovery API is an application for Splunk. It lets you search for existing domains and subdomains within Splunk.
Prerequisites
You need to have Splunk Enterprise installed and configured. To do so, please refer to the official documentation.
Configuring the extension
1. Log in to Splunk.
2. Download and install the application. This can be done from within Splunk. (https://splunkbase.splunk.com/app/5370)
3. You can start configuring immediately once the application is installed.
3.1 You can also configure the application on the Apps page. Click on Set up next to the application name.
4. Fill in your API key and click on Save.
Using the extension
1. On the Domains & Subdomains Discovery lookup page you can perform instant searches.
2. To integrate Domains & Subdomains Discovery into your script you can use the wxadnsdiscovery command. It takes 5 arguments: include_terms / exclude_terms providing comma-separated search strings with wildcard support, term_type (domains/subdomains) which specifies search context, since_date (optional, YYYY-MM-DD) to exclude results before the given date and api_key (optional) taken from config if not specified.
