topic external lookup in ui in Splunk Search

external lookup in ui

ytl — Fri, 08 Apr 2011 07:18:22 GMT

unfortunately i don't have access to the conf files on the filesystem on our splunk deployment. is there a way i can do the reverse dns as specified in http://www.splunk.com/base/Documentation/4.1.5/Knowledge/Addfieldsfromexternaldatasources from the ui? specifically i have my ip's in a field called dvc_ip

sideview — Fri, 08 Apr 2011 08:01:30 GMT

I think Splunk ships with that python script already there.

$SPLUNK_HOME/etc/system/bin/external_lookup.py

and everything else you shiuld be able to do in manager > Lookups

ytl — Wed, 13 Apr 2011 00:08:11 GMT

any chance you could walk me through how to map the conf files to the ui input boxes? cheers,