All Apps and Add-ons

Trouble with OpenDNS lookup Table

Volto
Path Finder

Hello,

I am trying to use the lookup table created by OpenDNS addon to include data from the OpenDNS cloud.

The structure of the lookup table is;

dest, last_queried, max_malware_sample_threat_score, rr_history.domain, rr_history.status, rr_history.status_label, rr_history.ttl.

My lookup query is; | lookup investigate_ips dest AS src_ip OUTPUT rr_history.status_label but this errors out "Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table."

I know that the addresses passed to the lookup table exist, and I don't get the error when I output rr_history. Has anyone gotten the lookup table to work?

0 Karma

byearwood_splun
Splunk Employee
Splunk Employee

Hi Volto,
- what version of opendns_investigate are you running please?
- is there a corresponding csv file
- also should the command not be |inputlookup, instead of |lookup?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...