Splunk Search

Time field not reflecting along with the inputlookup query

Prashant
Explorer

Hi Team,

I am using below query to get the DNS lookup query, everything is fine but I am not getting the time field aligned with my inputlookup query. If I remove the inputlookup and use the individual domain name then it works fine. however I would like to have the time as well along with my inputlookup data.

 

| makeresults
| inputlookup append=t dns.csv
| dnsquery domainfield=domain qtype="A" answerfield="dns_response" nss="10.102.204.52"
| eval Status = case(isnotnull(dns_error), "UnReachable",1=1 , "Reachable")
| eval DateTime=strftime(_time,"%a %B %d %Y %H:%M:%S")
| table DateTime domain dns_response dns_error Status

 

Result is showing as - 

DateTime domain dns_response dns_error Status

Wed September 18 2024 11:57:19   Reachable
 ns1.vodacombusiness.co.za41.0.1.10 Reachable
 ns2.vodacombusiness.co.za41.0.193.10 Reachable
 ns3.vodacombusiness.co.za-Could not execute DNS query: A -> ns3.vodacombusiness.co.za. Error: None of DNS query names exist: ns3.vodacombusiness.co.za., ns3.vodacombusiness.co.za.UnReachable
Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Prashant ,

from the inputlookup you don't have a timestamp _time.

If you want the now() timestamp you can try in this way:

| inputlookup dns.csv
| dnsquery domainfield=domain qtype="A" answerfield="dns_response" nss="10.102.204.52"
| eval DateTine=strftime(now(),"%a %B %d %Y %H:%M:%S")
| eval Status = case(isnotnull(dns_error), "UnReachable",1=1 , "Reachable")
| table DateTime domain dns_response dns_error Status

 Ciao.

Giuseppe

View solution in original post

Prashant
Explorer

Hi @gcusello - Ah got it. Thank you so much.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Prashant ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Prashant ,

from the inputlookup you don't have a timestamp _time.

If you want the now() timestamp you can try in this way:

| inputlookup dns.csv
| dnsquery domainfield=domain qtype="A" answerfield="dns_response" nss="10.102.204.52"
| eval DateTine=strftime(now(),"%a %B %d %Y %H:%M:%S")
| eval Status = case(isnotnull(dns_error), "UnReachable",1=1 , "Reachable")
| table DateTime domain dns_response dns_error Status

 Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...