Getting Data In

DNS Resolution Revisited

balcv
Contributor

I previously asked for some help on setting up dns resolution when performing searches and I got some great info and was able to get it all working. BUT, after a recent change in my Splunk install (the version I was using expired), the dns resolution will not work.

I have the required lines on my transforms.conf:
[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

Then in my search I have (where dst is the ip address I want resolved):
source="udp:64514" SSH_Connects | lookup dnsLookup dst

Rather than get the data I require with the dst resolved I get this error:
Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

Can anyone enlighten me on what I'm doing wrong.

Tags (2)
0 Karma

usethedata
Path Finder

My guess is that your script is not outputting the fields that are expected. Don't you need to do lookup dnsLookup ip as dst to get the ip address passed in with the right name?

balcv
Contributor

Thank you. That was what I needed. Search that now works is and gives resolved name, ip and count:
source="udp:64514" SSH_Connects | stats count by dst | lookup dnsLookup ip as dst | sort -count | table host dst count

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...