Ok,
Now I understand, you need to call several times to the lookup command, example:
index=pan_logs source="udp:51401" | lookup dnslookup clientip AS client_ip OUTPUT clienthost as client_host | lookup dnslookup clientip AS dest_ip OUTPUT clienthost as dest_host
Regards
... View more