https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447513#M126856 <P>Hello,</P> <P>I have the following tstats query that I do not understand why it is not returning the FQDN</P> <P>Here's the query I started off with that works:</P> <PRE><CODE>| tstats summariesonly=t count FROM datamodel="pan_firewall" where nodename="log" log.vendor_action!=allow groupby host,log. src_zone,log.src_ip,log.dest_zone,log.dest_ip,log.dest_port | rename log.* AS * | table host,src_zone,src_ip,dest_zone,dest_ip,dest_port </CODE></PRE> <P>In the following query, I want to resolve both the 'src_ip' and 'dest_ip' to a FQDN but is not working with no error notification or any indication the matched event counter was incrementing.</P> <PRE><CODE>|tstats summariesonly=t count FROM datamodel="pan_firewall" where nodename="log" log.vendor_action!=allow groupby host,log.src_zone,log.src_ip,log.dest_zone,log.dest_ip,log.dest_port | rename log.* AS * | lookup dnslookup clientip AS src_ip output clienthost AS src_hostname | lookup dnslookup clientip AS dest_ip output clienthost AS dest_hostname | table host,src_zone,src_ip,src_hostname,dest_zone,dest_ip,dest_hostname,dest_port </CODE></PRE> <P>If I run a similar command, the 'dnslookup' works.</P> <PRE><CODE> index=* sourcetype=* vendor_action!=allow | lookup dnslookup clientip AS src_ip output clienthost AS src_hostname | lookup dnslookup clientip AS dest_ip output clienthost AS dest_hostname | table host,src_zone,src_ip,src_hostname,dest_zone,dest_ip,dest_hostname,dest_port </CODE></PRE> Wed, 30 Sep 2020 00:25:36 GMT wmoy 2020-09-30T00:25:36Z https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447513#M126856 <P>Hello,</P> <P>I have the following tstats query that I do not understand why it is not returning the FQDN</P> <P>Here's the query I started off with that works:</P> <PRE><CODE>| tstats summariesonly=t count FROM datamodel="pan_firewall" where nodename="log" log.vendor_action!=allow groupby host,log. src_zone,log.src_ip,log.dest_zone,log.dest_ip,log.dest_port | rename log.* AS * | table host,src_zone,src_ip,dest_zone,dest_ip,dest_port </CODE></PRE> <P>In the following query, I want to resolve both the 'src_ip' and 'dest_ip' to a FQDN but is not working with no error notification or any indication the matched event counter was incrementing.</P> <PRE><CODE>|tstats summariesonly=t count FROM datamodel="pan_firewall" where nodename="log" log.vendor_action!=allow groupby host,log.src_zone,log.src_ip,log.dest_zone,log.dest_ip,log.dest_port | rename log.* AS * | lookup dnslookup clientip AS src_ip output clienthost AS src_hostname | lookup dnslookup clientip AS dest_ip output clienthost AS dest_hostname | table host,src_zone,src_ip,src_hostname,dest_zone,dest_ip,dest_hostname,dest_port </CODE></PRE> <P>If I run a similar command, the 'dnslookup' works.</P> <PRE><CODE> index=* sourcetype=* vendor_action!=allow | lookup dnslookup clientip AS src_ip output clienthost AS src_hostname | lookup dnslookup clientip AS dest_ip output clienthost AS dest_hostname | table host,src_zone,src_ip,src_hostname,dest_zone,dest_ip,dest_hostname,dest_port </CODE></PRE> Wed, 30 Sep 2020 00:25:36 GMT https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447513#M126856 wmoy 2020-09-30T00:25:36Z https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447514#M126857 <P>Just guessing here, did you check if the field <CODE>log.src_ip</CODE> is numeric in the datamodel?</P> <P>cheers, MuS</P> Sun, 05 May 2019 20:14:01 GMT https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447514#M126857 MuS 2019-05-05T20:14:01Z https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447515#M126858 <P>I ran your exact search but I inserted a <CODE>| head 10</CODE> after the <CODE>| rename</CODE> to speed it up and it worked fine; does yours work better if you limit the results this way?</P> Sun, 05 May 2019 23:00:00 GMT https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447515#M126858 woodcock 2019-05-05T23:00:00Z https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447516#M126859 <P>To answer my own question... after trying a number of different things ... turns out that the SPL syntax was fine.<BR /> What was happening was the number of results returned from the tstat for a 24hr window caused a huge resource consumption on search head.<BR /> I ended up running a dedup and reducing the time window to 10 mins to get the query returning the fqdn from dnslookup.</P> Thu, 09 May 2019 13:14:15 GMT https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447516#M126859 wmoy 2019-05-09T13:14:15Z https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447517#M126860 <P>Yes, log.src_ip is numeric in the datamodel</P> Thu, 09 May 2019 13:15:30 GMT https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447517#M126860 wmoy 2019-05-09T13:15:30Z https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447518#M126861 <P>Good idea and that lead me to answering my own question that I've just posted.</P> <P>Thanks.</P> Thu, 09 May 2019 13:18:55 GMT https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447518#M126861 wmoy 2019-05-09T13:18:55Z https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447519#M126862 <P>@wmoy If your problem is resolved, please accept the answer to help future readers.</P> Thu, 09 May 2019 14:43:28 GMT https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447519#M126862 richgalloway 2019-05-09T14:43:28Z https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447520#M126863 <P>Don't forget to <CODE>UpVote</CODE> and click <CODE>Accept</CODE> on your answer.</P> Thu, 09 May 2019 15:21:08 GMT https://community.splunk.com/t5/Splunk-Search/tstat-with-dnslookup-does-not-return-the-fqdn-for-an-IP-value/m-p/447520#M126863 woodcock 2019-05-09T15:21:08Z