Resolving IP in other fields

[adriangoodhead7]

I've managed to get my apache access logs into Splunk, and configured it to resolve the ip address in the client IP field. I have also captured some network traffic via wireshark and imported via .cvs file to splunk. I would like to work out how to resolve the ip address that is in the destination field.

Any help would be appreciated, as i'm new to splunk.

[adriangoodhead7]

Boom got it, just added the following to props.conf

[csv]
LOOKUP-rdns = dnsLookup ip AS Destination OUTPUTNEW host AS hostname

[yannK]

you can accept your own answer 🙂

[adriangoodhead7]

I've tried adding "Destination" to C:\Program Files\Splunk\etc\system\local\transforms.conf

dnsLookup]
external_cmd = external_lookup.py host ip Destination
fields_list = host, ip, Destination