https://community.splunk.com/t5/Getting-Data-In/DNSLOOKUP-for-a-Destination-Host-only-the-Source-Host-is-working/m-p/286429#M54654 <P>I am apparently doing something wrong with the Destination Host dnslookup, it shows the Source Host instead. Any ideas on why I can't translate the destination IP into a host? It should be pulling the IP from the log file name which is correct, the destination IP works. The Destination Host is the only thing incorrect.</P> <PRE><CODE>index = syslog sourcetype = cisco:ios configured | rex field=source "^/\w+/\w+/\w+/(?&lt;SourceIP&gt;\w+\.\w+\.\w+\.\w+).log" | eval "Destination IP" = SourceIP | eval "Source IP" = src_ip | lookup dnslookup clientip AS "Source IP" | eval "Source Host" = upper(clienthost) | lookup dnslookup clientip AS "Destination Host" | eval "Destination Host" = upper(clienthost) | eval Date = strftime(_time,"%m-%d-%Y %I:%M") | eval Username = upper(user) | eval Message = upper(message_text) | eventstats count AS "Event Count" BY Date "Source IP" "Destination IP" Username Message | dedup Date "Destination IP" Username Message | table Date "Source IP" "Source Host" "Destination IP" "Destination Host" Username Message "Event Count" | sort Date "Destination IP" Desc </CODE></PRE> Wed, 21 Oct 2015 16:58:27 GMT rfiscus 2015-10-21T16:58:27Z https://community.splunk.com/t5/Getting-Data-In/DNSLOOKUP-for-a-Destination-Host-only-the-Source-Host-is-working/m-p/286429#M54654 <P>I am apparently doing something wrong with the Destination Host dnslookup, it shows the Source Host instead. Any ideas on why I can't translate the destination IP into a host? It should be pulling the IP from the log file name which is correct, the destination IP works. The Destination Host is the only thing incorrect.</P> <PRE><CODE>index = syslog sourcetype = cisco:ios configured | rex field=source "^/\w+/\w+/\w+/(?&lt;SourceIP&gt;\w+\.\w+\.\w+\.\w+).log" | eval "Destination IP" = SourceIP | eval "Source IP" = src_ip | lookup dnslookup clientip AS "Source IP" | eval "Source Host" = upper(clienthost) | lookup dnslookup clientip AS "Destination Host" | eval "Destination Host" = upper(clienthost) | eval Date = strftime(_time,"%m-%d-%Y %I:%M") | eval Username = upper(user) | eval Message = upper(message_text) | eventstats count AS "Event Count" BY Date "Source IP" "Destination IP" Username Message | dedup Date "Destination IP" Username Message | table Date "Source IP" "Source Host" "Destination IP" "Destination Host" Username Message "Event Count" | sort Date "Destination IP" Desc </CODE></PRE> Wed, 21 Oct 2015 16:58:27 GMT https://community.splunk.com/t5/Getting-Data-In/DNSLOOKUP-for-a-Destination-Host-only-the-Source-Host-is-working/m-p/286429#M54654 rfiscus 2015-10-21T16:58:27Z https://community.splunk.com/t5/Getting-Data-In/DNSLOOKUP-for-a-Destination-Host-only-the-Source-Host-is-working/m-p/286430#M54655 <P>This fixed it, thanks Bert!</P> <PRE><CODE>| rename clienthost AS "Source Host" | lookup dnslookup clientip AS SourceIP | eval "Destination Host" = upper(clienthost) </CODE></PRE> Wed, 21 Oct 2015 18:52:17 GMT https://community.splunk.com/t5/Getting-Data-In/DNSLOOKUP-for-a-Destination-Host-only-the-Source-Host-is-working/m-p/286430#M54655 rfiscus 2015-10-21T18:52:17Z