https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160461#M32530 <P>I've managed to get my apache access logs into Splunk, and configured it to resolve the ip address in the client IP field. I have also captured some network traffic via wireshark and imported via .cvs file to splunk. I would like to work out how to resolve the ip address that is in the destination field. </P> <P>Any help would be appreciated, as i'm new to splunk.</P> Fri, 29 Nov 2013 13:06:49 GMT adriangoodhead7 2013-11-29T13:06:49Z https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160461#M32530 <P>I've managed to get my apache access logs into Splunk, and configured it to resolve the ip address in the client IP field. I have also captured some network traffic via wireshark and imported via .cvs file to splunk. I would like to work out how to resolve the ip address that is in the destination field. </P> <P>Any help would be appreciated, as i'm new to splunk.</P> Fri, 29 Nov 2013 13:06:49 GMT https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160461#M32530 adriangoodhead7 2013-11-29T13:06:49Z https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160462#M32531 <P>I've tried adding "Destination" to C:\Program Files\Splunk\etc\system\local\transforms.conf</P> <P>dnsLookup]<BR /> external_cmd = external_lookup.py host ip Destination<BR /> fields_list = host, ip, Destination</P> Mon, 28 Sep 2020 15:23:25 GMT https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160462#M32531 adriangoodhead7 2020-09-28T15:23:25Z https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160463#M32532 <P>Boom got it, just added the following to props.conf</P> <P>[csv]<BR /> LOOKUP-rdns = dnsLookup ip AS Destination OUTPUTNEW host AS hostname</P> Fri, 29 Nov 2013 15:00:03 GMT https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160463#M32532 adriangoodhead7 2013-11-29T15:00:03Z https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160464#M32533 <P>you can accept your own answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 29 Nov 2013 18:03:02 GMT https://community.splunk.com/t5/Getting-Data-In/Resolving-IP-in-other-fields/m-p/160464#M32533 yannK 2013-11-29T18:03:02Z