Splunk Search

IP to Name

vistasyslog
New Member

I cannot get the hostnames in place of IP's on the summary screen. I need to get it done through the .csv file option and not DNS.

.CSV file contents reads :

IP,Name
10.12.0.132,AUS-BROCADE-10G-2
10.12.100.9,AUS-VG1
10.12.100.8,AUS-VG2

Transforms.conf :

[hostnames]
filename = hostnames.csv

props.conf :

[access_combined]
Lookup-hostnames = Hostnames ip AS IP OUTPUT Name

Can you tell me if there is something that I need to change.

I have added the .csv file as a lookup table, pointed a lookup definition to it.
When I perform this search :

sourcetype="syslog" | lookup hostnames host AS IP OUTPUT Name

I get the following error :

Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table

The .csv file is in the system/lookups folder.

Tags (3)
0 Karma

Ayn
Legend

You have the fields in the wrong order in your lookup command, they should be the other way around:

... | lookup hostnames IP AS host OUTPUT Name
0 Karma

Ayn
Legend

It's not "Lookup", it's LOOKUP, all caps.

0 Karma

vistasyslog
New Member

My entire props.conf reads :

[source::udp:514]
TRANSFORMS-changesourcetype = riverbed_steelhead, sourcetype_cisco_asa

[access_combined]
Lookup-hostnames = hostnames ip AS IP OUTPUTNEW Name

0 Karma

vistasyslog
New Member

I tried this command., I still get the same error.
I also get the error :

Possible Typo in the first stanza [access_combined] in props.conf file.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...