I'm a beginner at this... but i love to know more!
I have a mail log that i like to extract the connection hostname from.
I have sorted out all the intresting lines:
"
Dec 1 04:02:42 mailgw1 postfix/smtpd[15515]: connect from unknown[XXX.YYY.ZZZ.NNN]
"
But when i try to get the IPadresses to hostnames i just hit the brick wall 😞
I'm ending up with a list of "unknown[XXX.YYY.ZZZ.NNN]" and i just love to resolve that to a hostname and make a nice chart for the boss... and a clear list for the developer that are trying to change mail system...
To add to Luke's answer, this script and lookup mechanism is described in the Splunk documentation
It sounds like you are looking to resolve the host name from an IP. Splunk ships with a script that can do this at index time, which means once configured only new events will be resolved.
Check out this answer:
http://answers.splunk.com/answers/105246/dns-resolution-in-a-search