topic DNS lookup failing in Getting Data In

DNS lookup failing

huaraz — Mon, 28 Sep 2020 09:52:11 GMT

I read http://www.splunk.com/base/Documentation/4.2.2/Knowledge/Addfieldsfromexternaldatasources and see my default transform.conf has

# Example external lookup

[dnslookup]

external_cmd = external_lookup.py clienthost clientip

fields_list = clienthost clientip

But when I try to use it I get "Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table."

I use:
"Local User:" AND NOT DNS AND NOT close | rex field=_raw "User:\s+(?.):.\s+->\s+(?.*):" | top limit 20 dst | lookup dnslookup dst

The logfile entries look like:

Aug 25 23:00:22 Vigor: Local User: 192.168.1.8:50829 -> 22.58.244.67:80 (TCP)Web

Thank you
Markus

Re: DNS lookup failing

huaraz — Sun, 04 Sep 2011 14:30:14 GMT

I think I found the answer myself. I have to use the fields which are listed in the transform.conf.

Markus

Re: DNS lookup failing

lrhazi — Mon, 21 May 2012 02:50:37 GMT

Looks like you needed: lookup dnslookup clientip as dst

Re: DNS lookup failing

pryzrak — Fri, 15 Nov 2013 23:31:20 GMT

The search below is another option:

<search> | lookup dnslookup clientip as dst | fillnull value=unknown

Just get rid of your two 'eval's.

Re: DNS lookup failing

LeedhamB_80746 — Wed, 11 Oct 2017 17:32:42 GMT

I encountered a similar issue with syntax, which the posts above helped me solve. I'm documenting the "why" as to the failed resolution for future reference.

Initially I was submitting a search similar to:
ClientIP="8.8.8.8" | lookup dnslookup ClientIP

Results in error:
"Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table"

Within the dnslookup script, clientip and clienthost:
1) are case sensitive
2) set forward or reverse dns resolution
3) are preconfigured in the dnslookup script
4) are required for dnslookup to function

These variables set functionality for forward or reverse dns resolution as flags/switches that must be present for the lookup to function correctly. The command "AS ___" actually passes the field/variable to the dnslookup script for resolution.

Correct lookup examples (with comparisons):
Resolve-dns.ps1 -f "google[.]com"
ClientHost="google[.]com" | lookup dnslookup clienthost AS ClientHost

Resolve-dns.ps1 -r "8.8.8.8"
ClientIP="8.8.8.8" | lookup dnslookup clientip AS ClientIP