resolving hostnames from a mail log

[christerhe]

I'm a beginner at this... but i love to know more!

I have a mail log that i like to extract the connection hostname from.
I have sorted out all the intresting lines:

"
Dec 1 04:02:42 mailgw1 postfix/smtpd[15515]: connect from unknown[XXX.YYY.ZZZ.NNN]
"

But when i try to get the IPadresses to hostnames i just hit the brick wall 😞

I'm ending up with a list of "unknown[XXX.YYY.ZZZ.NNN]" and i just love to resolve that to a hostname and make a nice chart for the boss... and a clear list for the developer that are trying to change mail system...

[muebel]

To add to Luke's answer, this script and lookup mechanism is described in the Splunk documentation

[lukejadamec]

It sounds like you are looking to resolve the host name from an IP. Splunk ships with a script that can do this at index time, which means once configured only new events will be resolved.

Check out this answer:

http://answers.splunk.com/answers/105246/dns-resolution-in-a-search