The problem I am trying to solve is the following: if src_hostfield is missing, null or empty, add it to events by performing DNS resolution as indicated on http://answers.splunk.com/answers/105246/dns-resolution-in-a-search.html. However, if it is already present, don't touch it.
The simples way to do this would be if DNS resolution was available as an eval command and I could do something like eval src_host=coalesce(src_host, lookup(src_ip)). However, I was unable to find a way to do lookups outside of a search command.
eval src_host=coalesce(src_host, lookup(src_ip))
Any ideas on how to achieve a similar result?
Turns out I found a way to do this using join. Assuming there's a macro called my_events which selects the CIM-compliant events, this is what is looks like:
`my_event` | join type=left src_ip [ search `my_event` NOT src_host="*" | fields src_ip | fields - _* | dedup src_ip | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS src_host_resolved ] | eval src_host=coalesce(src_host, src_host_resolved)
One interesting advantage is that I am doing a single DNS lookup of each unique source IP address for which there are events with no src_host field.
View solution in original post