topic Re: IP to Name in Splunk Search

IP to Name

vistasyslog — Fri, 11 Jan 2013 16:19:54 GMT

I cannot get the hostnames in place of IP's on the summary screen. I need to get it done through the .csv file option and not DNS.

.CSV file contents reads :

IP,Name
10.12.0.132,AUS-BROCADE-10G-2
10.12.100.9,AUS-VG1
10.12.100.8,AUS-VG2

Transforms.conf :

[hostnames]
filename = hostnames.csv

props.conf :

[access_combined]
Lookup-hostnames = Hostnames ip AS IP OUTPUT Name

Can you tell me if there is something that I need to change.

I have added the .csv file as a lookup table, pointed a lookup definition to it.
When I perform this search :

sourcetype="syslog" | lookup hostnames host AS IP OUTPUT Name

I get the following error :

Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table

The .csv file is in the system/lookups folder.

Ayn — Fri, 11 Jan 2013 16:21:08 GMT

You have the fields in the wrong order in your lookup command, they should be the other way around:

... | lookup hostnames IP AS host OUTPUT Name

vistasyslog — Fri, 11 Jan 2013 16:43:49 GMT

I tried this command., I still get the same error.
I also get the error :

Possible Typo in the first stanza [access_combined] in props.conf file.

vistasyslog — Mon, 28 Sep 2020 13:05:35 GMT

My entire props.conf reads :

[source::udp:514]
TRANSFORMS-changesourcetype = riverbed_steelhead, sourcetype_cisco_asa

[access_combined]
Lookup-hostnames = hostnames ip AS IP OUTPUTNEW Name

Ayn — Fri, 11 Jan 2013 18:56:43 GMT

It's not "Lookup", it's LOOKUP, all caps.