Splunk Search

How to resolve IP to external hostname and list it in a field?

chrisprangnell
Path Finder

Hello,

I've been reading a lot of posts here, but I seem to be missing something because I'm not understanding.

Search Rule

ACCEPT |  lookup dnslookup clientip AS src_ip OUTPUT clienthost as Hostname

Output

5/13/16
2:37:03.000 PM  
2 698177307011 eni-8eceafeb 54.187.193.193 172.31.8.32 443 50656 6 8 3684 1463114223 1463114226 ACCEPT OK
dest_ip = 172.31.8.32 host = ip-10-20-6-215 src_ip = 54.187.193.193
5/13/16

I'm not getting any new field called "hostname" and it certainly isn't populating with a resolved DNS.

What am I missing? I want to see all the resolved IP's hostnames in a field populated.

Any assistance appreciated.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please go to settings -> lookups -> lookup definitions and see if you have a lookup named "dnslookup"

If it is there, make sure it is enabled and shared with the desired permissions.

Then, make sure the splunk server that is executing the lookup has proper DNS servers setup.

Finally check "index=_internal log_level=warn* OR log_level=err*" and "index=_internal external_lookup.py" for any errors, and let us know what you find.

0 Karma

sundareshr
Legend

In addition, insure dnslookup definition is mapped to the right .csv file. Also remember the field names (in & out) are case-sensitive. Its probably just a typo, but you have Hostname with upper & lower "h" in your question.

0 Karma

jkat54
SplunkTrust
SplunkTrust

@sundareshr, the dnslookup lookup is an external lookup that uses a python script. If the op doesnt have it, then it's probably due to their version of splunk. It was news to me as well, but I do have this lookup in splunk 6.4 on my local machine.

0 Karma

sundareshr
Legend

Good to know. Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...