topic DNS Resolution Revisited in Getting Data In

DNS Resolution Revisited

balcv — Mon, 28 Sep 2020 15:10:06 GMT

I previously asked for some help on setting up dns resolution when performing searches and I got some great info and was able to get it all working. BUT, after a recent change in my Splunk install (the version I was using expired), the dns resolution will not work.

I have the required lines on my transforms.conf:
[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

Then in my search I have (where dst is the ip address I want resolved):
source="udp:64514" SSH_Connects | lookup dnsLookup dst

Rather than get the data I require with the dst resolved I get this error:
Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

Can anyone enlighten me on what I'm doing wrong.

Re: DNS Resolution Revisited

usethedata — Fri, 01 Nov 2013 02:14:33 GMT

My guess is that your script is not outputting the fields that are expected. Don't you need to do lookup dnsLookup ip as dst to get the ip address passed in with the right name?

Re: DNS Resolution Revisited

balcv — Fri, 01 Nov 2013 03:03:52 GMT

Thank you. That was what I needed. Search that now works is and gives resolved name, ip and count:
source="udp:64514" SSH_Connects | stats count by dst | lookup dnsLookup ip as dst | sort -count | table host dst count