Time field not reflecting along with the inputlookup query

[Prashant]

Hi Team,

I am using below query to get the DNS lookup query, everything is fine but I am not getting the time field aligned with my inputlookup query. If I remove the inputlookup and use the individual domain name then it works fine. however I would like to have the time as well along with my inputlookup data.

| makeresults
| inputlookup append=t dns.csv
| dnsquery domainfield=domain qtype="A" answerfield="dns_response" nss="10.102.204.52"
| eval Status = case(isnotnull(dns_error), "UnReachable",1=1 , "Reachable")
| eval DateTime=strftime(_time,"%a %B %d %Y %H:%M:%S")
| table DateTime domain dns_response dns_error Status

Result is showing as - 

DateTime domain dns_response dns_error Status

Wed September 18 2024 11:57:19				Reachable
	ns1.vodacombusiness.co.za	41.0.1.10		Reachable
	ns2.vodacombusiness.co.za	41.0.193.10		Reachable
	ns3.vodacombusiness.co.za	-	Could not execute DNS query: A -> ns3.vodacombusiness.co.za. Error: None of DNS query names exist: ns3.vodacombusiness.co.za., ns3.vodacombusiness.co.za.	UnReachable

[Prashant]

Hi @gcusello - Ah got it. Thank you so much.

[gcusello]

Hi @Prashant ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @Prashant ,

from the inputlookup you don't have a timestamp _time.

If you want the now() timestamp you can try in this way:

| inputlookup dns.csv
| dnsquery domainfield=domain qtype="A" answerfield="dns_response" nss="10.102.204.52"
| eval DateTine=strftime(now(),"%a %B %d %Y %H:%M:%S")
| eval Status = case(isnotnull(dns_error), "UnReachable",1=1 , "Reachable")
| table DateTime domain dns_response dns_error Status

 Ciao.

Giuseppe