Ever since about splunk v5 it is built-in; just use it like this:
| inputlookup ipnl.csv | fields dest | lookup dnslookup clientip AS dest OUTPUT clienthost AS desthost | outputlookup dns.csv
You need to use the custom lookup command instead.
See https://lukemurphey.net/projects/network-tools/wiki/Using_Lookups for details.
You would need to do something like this:
| inputlookup "ipnl.csv" | fields dest | lookup nslookup host as dest | table _raw aaaa a mx ns server
Hi @LukeMurphey ,
I'm trying to configure DNS resolution for the but I'm a bit confused that how to use lookup defination dsnlookup and nslookup.
I'm not getting any values in aaaa, mx, ns and _raw while trying nslookup
Can you help me out how can I configure this or what I'm doing wrong.