URL Toolbox: What is the most efficient way to map URLs with IPs to meaningful names to graph on a time chart?

[caradoc]

Using URL Toolbox to parse out ut_domain for varying levels of analysis - I've come up with a couple of different ways to map ut_domain to some meaningful name instead of winding up with a timechart of eight IP addresses all graphed separately with a few additional entries (google.com, apple.com, etc.), but I'm at a loss as to the most efficient way to do it. Making individual DNS queries for each unqualified IP in ut_domain is not very efficient. Placing a table of "if this is the IP in ut_domain, use this string instead for ut_domain" seems to work, but I have to think there's a better way.

Thoughts?

[janderson19]

You could put those IPs and their names into a lookup table. I personally don't know much about lookups buy you could try it

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Lookup