Splunk Search

Dnslookup to output multiple event list in one query

neelu123
Explorer

Hello Team,

Can someone pls help me to built a query using dnslookup to output multiple evnt from the event list in a single query.

index=pan_logs source="udp:51401" |lookup dnslookup clientip AS client_ip OUTPUT clienthost as client_host

The above query works perfectly but in the search event I have multiple event list which is having ip addtress which I want to get the mapped host name with the above query. Tried other possible options but its not working.

Please help me one this or suggest if there is any other way to achieve this .

Regards,
Neelu

Tags (1)
0 Karma

gfuente
Motivator

Ok,

Now I understand, you need to call several times to the lookup command, example:

index=pan_logs source="udp:51401" | lookup dnslookup clientip AS client_ip OUTPUT clienthost as client_host | lookup dnslookup clientip AS dest_ip OUTPUT clienthost as dest_host

Regards

0 Karma

neelu123
Explorer

Thanx for you response, in my case client_ip is not a multi value field instead its one of the interesting field when I execute the search, like that there are more interesting fields like dest_ip,server_ip,src_ip etc etc,

if I execute the below query like the below I am getting error.

index=pan_logs source="udp:51401" | lookup dnslookup clientip AS client_ip,destip as dest_ip OUTPUT clienthost as client_host , desthost as dest_host

hope you understood my requirement.

Regards,
Neelu

0 Karma

gfuente
Motivator

Hello

If your client_ip field, it´s a multivalue field, you could use the mvexpand command to create new events, one per ip value:

https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Mvexpand

Something like

index=pan_logs source="udp:51401" | mvexpand client_ip |lookup dnslookup clientip AS client_ip OUTPUT clienthost as client_host

Regards

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...