Multiple Lookups from Sourcetype

[paulf]

Hi,
Is it possible to perform a more than 1x lookup on a number of fields?

I have 2x IP fields, one is a source ip another a destination ip.

I have the following in my props.conf.

[radware]
LOOKUP-rdns = dnsLookup ip AS rad_attack_target_ip OUTPUTNEW host AS rad_attack_target_host
LOOKUP-rdns = dnsLookup ip AS rad_attack_source_ip OUTPUTNEW host AS rad_attack_source_host

The lookups are working, however only one of them. It is always the last one that works. For instance with the above configuration the hostnames will appear for rad_attack_source_host but not for the rad_attack_target_host.

If i swap the lookups around, the rad_attack_source_host will have no data, but the rad_attack_target_host will.

Thanks
Paul

[Ayn · Accepted solution]

First thing I spot is that you don't have unique identifiers for your LOOKUP definitions. Both the first and second one is called "LOOKUP-rdns". These identifiers need to be unique, because that's how Splunk keeps track of them. So, if you have two with the same name, the second one is most likely "overwriting" the first. So if you call them something like "LOOKUP-rdns1" and "LOOKUP-rdns2" you might solve your problem. (or at least we can go on to the next step of troubleshooting 😉 )

[paulf]

Hi,

Thanks! that has resolved my issue...