DNS lookup failing

[huaraz]

Hi

I read http://www.splunk.com/base/Documentation/4.2.2/Knowledge/Addfieldsfromexternaldatasources and see my default transform.conf has

# Example external lookup

[dnslookup]

external_cmd = external_lookup.py clienthost clientip

fields_list = clienthost clientip

But when I try to use it I get "Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table."

I use:
"Local User:" AND NOT DNS AND NOT close | rex field=_raw "User:\s+(?.):.\s+->\s+(?.*):" | top limit 20 dst | lookup dnslookup dst

The logfile entries look like:

Aug 25 23:00:22 Vigor: Local User: 192.168.1.8:50829 -> 22.58.244.67:80 (TCP)Web

Thank you
Markus

[LeedhamB_80746]

I encountered a similar issue with syntax, which the posts above helped me solve. I'm documenting the "why" as to the failed resolution for future reference.

Initially I was submitting a search similar to:
ClientIP="8.8.8.8" | lookup dnslookup ClientIP

Results in error:
"Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table"

Within the dnslookup script, clientip and clienthost:
1) are case sensitive
2) set forward or reverse dns resolution
3) are preconfigured in the dnslookup script
4) are required for dnslookup to function

These variables set functionality for forward or reverse dns resolution as flags/switches that must be present for the lookup to function correctly. The command "AS ___" actually passes the field/variable to the dnslookup script for resolution.

Correct lookup examples (with comparisons):
Resolve-dns.ps1 -f "google[.]com"
ClientHost="google[.]com" | lookup dnslookup clienthost AS ClientHost

Resolve-dns.ps1 -r "8.8.8.8"
ClientIP="8.8.8.8" | lookup dnslookup clientip AS ClientIP

[pryzrak]

The search below is another option:

<search> | lookup dnslookup clientip as dst | fillnull value=unknown

Just get rid of your two 'eval's.

[lrhazi]

Looks like you needed: lookup dnslookup clientip as dst

[huaraz]

I think I found the answer myself. I have to use the fields which are listed in the transform.conf.

"Local User:" AND NOT DNS AND NOT close | rex field=_raw "User:s+(?.):.s+->s+(?.*):" | top limit 20 dst | eval clientip=dst | eval clienthost="unknown" | lookup dnslookup clientip

Markus