I'm following the instructions for implementing a reverse DNS lookup at search time. I either get an error saying the fields couldn't be found or I don't get the output I'm expecting.
I copied the external_lookup.py to /etc/apps/search/bin
Transforms.conf:
[dnslookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip
Props.conf:
[nessus]
LOOKUP-rdns = dnslookup ip OUTPUT host AS hostname
I also tried OUTPUTNEW per the example in:
http://docs.splunk.com/Documentation/Splunk/4.3/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_...
What am I doing wrong here? The hostname field is empty if I run a search such as:
sourcetype=nessus NOT timestamps | dedup host | rename dest_ip AS ip | lookup dnslookup ip | table ip, hostname
Thx.
