topic Re: lookup hostname to ip address but output different results? in Splunk Search

lookup hostname to ip address but output different results?

hjwang — Mon, 28 Sep 2020 11:25:11 GMT

Hi~there

i found that when using external_lookup.py provided in $SPLUNK_HOME/etc/system/bin/, the lookup results sometimes will be different results. for example, when lookup "host.com", the results sometimes return A.B.C.D, and sometimes return E.F.G.H, does there somebody know how to fix it? thanks in advance.

Re: lookup hostname to ip address but output different results?

willthames2 — Mon, 20 Feb 2012 03:25:10 GMT

This is most likely an artifact of domain name resolution rather than anything to do with Splunk.

Asking for the IP address of host.com may well give you different values at different times, for instance if there is more than one A record associated with the domain.

What specific problems does this cause you - perhaps if we know why you need the DNS lookup to remain consistent, your problem can be solved in a different way.

Re: lookup hostname to ip address but output different results?

hjwang — Mon, 20 Feb 2012 04:03:26 GMT

Thanks, willthames2. But what confused me is why the different results occurred within 1 minute, all i wanna do is to make sure the result is accurate when doing statistics by ip address, e.g. country. even when i open python interpreter to call socket.gethostbyname_ex(host.com), the result is always the same. so weird.