Resolve IP address

[sojourner9]

Pulling syslog messages out of a logfile on the server.

Right now in the splunk/etc/system/local/transforms.conf I Have this -
DEST_KEY = MetaData:Host
REGEX = (^(\w|-|.)*)\s
FORMAT = host::$1

And that pulls the IP address out of the message fine. On the GUI when I do a search on source="/log/syslog" the entries are showing host="ipaddress" rather than host="hostname"

Now how do I get it to do a lookup and replace the IP address with a hostname ?

Splunk version 4.3.3, build 128297

[sdaniels]

This should help.

http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources

Here's an example of how you might use external lookups to match with information from a DNS server. Splunk ships with a script located in $SPLUNK_HOME/etc/system/bin/ called external_lookup.py, which is a DNS lookup script that:

if given a host, returns the IP address.
if given an IP address, returns the host name. 

1. In a transforms.conf file, put:

[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip

1. In a props.conf file, put:

[access_combined]
LOOKUP-dns = dnsLookup host OUTPUT ip AS clientip

The field in the lookup table is named ip, but Splunk automatically extracts the IP addresses from Web access logs into a field named clientip. So, "OUTPUT ip AS clientip" indicates that you want Splunk to add the values of ip from the lookup table into the clientip field in the events. Since the host field has the same name in the lookup table and the events, you don't need to rename the field.

For a reverse DNS lookup, your props.conf stanza would be:

[access_combined]
LOOKUP-rdns = dnsLookup ip AS clientip OUTPUTNEW host AS hostname

For this example, instead of overwriting the host field value, you want Splunk to return the host value in a new field, called hostname

1. Restart Splunk.

Previous questions asked on this:

http://splunk-base.splunk.com/answers/30075/dns-lookup-failing
http://splunk-base.splunk.com/answers/8051/dns-lookup-via-splunk

[perichandra]

Hi is caching of the look ups automatically performed by Splunk in this case to prevent degradation of performance.