I've managed to get my apache access logs into Splunk, and configured it to resolve the ip address in the client IP field. I have also captured some network traffic via wireshark and imported via .cvs file to splunk. I would like to work out how to resolve the ip address that is in the destination field.
Any help would be appreciated, as i'm new to splunk.
I've tried adding "Destination" to C:\Program Files\Splunk\etc\system\local\transforms.conf
external_cmd = external_lookup.py host ip Destination
fields_list = host, ip, Destination