Dnslookup to output multiple event list in one query

[neelu123]

Hello Team,

Can someone pls help me to built a query using dnslookup to output multiple evnt from the event list in a single query.

index=pan_logs source="udp:51401" |lookup dnslookup clientip AS client_ip OUTPUT clienthost as client_host

The above query works perfectly but in the search event I have multiple event list which is having ip addtress which I want to get the mapped host name with the above query. Tried other possible options but its not working.

Please help me one this or suggest if there is any other way to achieve this .

Regards,
Neelu

[gfuente]

Ok,

Now I understand, you need to call several times to the lookup command, example:

index=pan_logs source="udp:51401" | lookup dnslookup clientip AS client_ip OUTPUT clienthost as client_host | lookup dnslookup clientip AS dest_ip OUTPUT clienthost as dest_host

Regards

[neelu123]

Thanx for you response, in my case client_ip is not a multi value field instead its one of the interesting field when I execute the search, like that there are more interesting fields like dest_ip,server_ip,src_ip etc etc,

if I execute the below query like the below I am getting error.

index=pan_logs source="udp:51401" | lookup dnslookup clientip AS client_ip,destip as dest_ip OUTPUT clienthost as client_host , desthost as dest_host

hope you understood my requirement.

Regards,
Neelu

[gfuente]

Hello

If your client_ip field, it´s a multivalue field, you could use the mvexpand command to create new events, one per ip value:

https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Mvexpand

Something like

index=pan_logs source="udp:51401" | mvexpand client_ip |lookup dnslookup clientip AS client_ip OUTPUT clienthost as client_host

Regards