Reverse DNS Lookup not working

[shocko]

Guys, the following query will return the hostname and resolved IP address form a windows event:

index = myindex="WinEventLog:Directory Service" EventCode=2889| lookup dnslookup clienthost as host | table host,clientip

However, a reverse lookup on a calculated IP address from the same event never resolves the IP address to a hostname i.e. clienthost is not populated

index = myindex source="WinEventLog:Directory Service" EventCode=2889 | rex field=_raw "(?s)IP address:(?.?):.:(?.)" | lookup dnslookup clientip As cip OUTPUT clienthost | table cip,clienthost*

DNS on the underlying windows server is fine. My transforms.conf file stanza is as follows:

[dnslookup]
external_cmd = external_lookup.py clienthost clientip
fields_list = clienthost,clientip

Please help! driving me nuts.

[hunters_splunk]

Hi shocko,

Seems your rex syntax is not correct.
When you use the rex command, you must specify a new field name (in brackets) to which to assign the regex-captured group.
For example, extract "from" and "to" fields using regular expressions. If a raw event contains "From: Susan To: Bob", then from=Susan and to=Bob.

... | rex field=_raw "From: (?<from>.*) To: (?<to>.*)"

For more information, please refer to documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Rex

Hope this helps. Thanks!
Hunter

[shocko]

Apologies, I have edited my original post! the cip rex was working. The issues was the actual rex I was performing needed to account for line breaks. this works for me:

index = corp-dc source="WinEventLog:Directory Service" EventCode=2889 | rex field=_raw "(?s)IP address:\D*(?.?):.:(?.)" | lookup dnslookup clientip As cip OUTPUT clienthost | table cip,clienthost*

thanks to my vendor engineer Keith for pointing this one out! 😉