Help converting raw text into a simple stats table showing hostname and destination

[gabarrygowin]

Hi all,

Thanks for reading. I've tried a bunch of the offerings in the >answers forum with no luck. Here's my effort:

Need the following raw text to convert into a simple stats table showing hostname and destination.

Raw text:
8/23/17
6:29:10.000 PM

Aug 23 18:29:10 asbcnspap02.gab.com 08/23/2017:18:29:10 asbcnspap02 0-PPE-1 : default TCP CONN_TERMINATE 23913664 0 : Source 10.XXX.XXX.29:443 - Destination 10.120.209.12:4911 - Start Time 08/24/2017:01:28:25 GMT - End Time 08/24/2017:01:29:10 GMT - Total_bytes_send 1 - Total_bytes_recv 1

Current search (not resolving):

index=infrastructure 10.120.213.29 | stats count by Source, Destination | lookup dnslookup clienthost OUTPUT clientip 

Any help MUCH appreciated!

[somesoni2]

Try like this

index=infrastructure 10.120.213.29 | stats count by Source, Destination | lookup dnslookup clientip as Source OUTPUT clienthost as Source_Host   | lookup dnslookup clientip as Destination OUTPUT clienthost as Destination_Host 

[s2_splunk]

Note that the search (before the first "|") resolves to index=infrastructure 10 AND 120 AND 213 AND 29, because the '.' is a minor segmenter, so it breaks up the IP address into four individual terms. Hence, it may not retrieve exactly what you need. (You can see the search being executed in the search.log, found in the Job Inspector, if you search for "Lispy")
Example:
08-24-2017 01:18:18.579 INFO UnifiedSearch - Expanded index search = ( index=infrastructure 10.120.213.29 )
08-24-2017 01:18:18.580 INFO UnifiedSearch - base lispy: [ AND 10 120 213 29 index::infrastructure ]

Docs for how to handle it here

[gabarrygowin]

Thanks much sslevert!

I finally got that all figured out and appreciate the leading help.

[s2_splunk]

Cool. Please accept somesoni2's answer to mark it as resolved for posterity.