Splunk Search

lookup hostname to ip address but output different results?

hjwang
Contributor

Hi~there

i found that when using external_lookup.py provided in $SPLUNK_HOME/etc/system/bin/, the lookup results sometimes will be different results. for example, when lookup "host.com", the results sometimes return A.B.C.D, and sometimes return E.F.G.H, does there somebody know how to fix it? thanks in advance.

Tags (1)
0 Karma

hjwang
Contributor

Thanks, willthames2. But what confused me is why the different results occurred within 1 minute, all i wanna do is to make sure the result is accurate when doing statistics by ip address, e.g. country. even when i open python interpreter to call socket.gethostbyname_ex(host.com), the result is always the same. so weird.

0 Karma

willthames2
Path Finder

This is most likely an artifact of domain name resolution rather than anything to do with Splunk.

Asking for the IP address of host.com may well give you different values at different times, for instance if there is more than one A record associated with the domain.

What specific problems does this cause you - perhaps if we know why you need the DNS lookup to remain consistent, your problem can be solved in a different way.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...