Hello,
I´ve been working with lookup and its working fine, I used this :
" | lookup dnslookup clientip
as src OUTPUT clienthost | table _time clienthost src "
It can resolve Publics IPs by his www hostname but somehow the internal IP just resolve the IP that are within the windows Domains, the others IP that are internal but no in the domains, can not.
I tried to review the DNS ( cat /etc/resolv.conf) of the SPLUNK Search, and this is the results,
cat /etc/resolv.conf
[root@genosis ~]# cat /etc/resolv.conf
Generated by NetworkManager
search metrodom.cl
nameserver 172.16.20.36
nameserver 172.16.20.34
[root@genosis ~]#
I tested in my Pc , that it has the same DNS and I got this result
Do you have any idea, how can I put this resolved address in the clienthost field?
