I am trying to use the results of dnslookup to pivot the results to query my index.
| makeresults
| eval domain="google.com"
| lookup dnslookup clienthost as domain OUTPUT clientip
| search index=myindex ip=clientip
The end goal would be to create a text token for a dashboard so any domain could be entered where "google.com" is. Then i want to see if the ip is in my index under the ip field.
