Hello, I have data with internal and external IP addresses. Every event has either an internal source or destination IP. For all internal IP addresses, I have prior created a lookup table with ip, ip_resolved and the department which is taken from part of the host name (this lookup should prevent having to do too many dns lookups at search time and gets updated every day). The ip_resolved field is the resolved DNS Name using Splunk's external_lookup.py script, and in cases where no DNS name is found, ip_resolved and department are successfully fillnulled with the value "not found".
Now, when I set up an automatic lookup for each the source and destination ip, about 15% of the results for ip_resolved are the value NONE, which is the default value for my lookup definition. If I make sure that I filter my search to only show events where the destination IP is internal, no NONE values are returned (but some "not found", as expected). I think it's maybe because destination comes before source alphabetically, and Splunk does that lookup first which then breaks the source lookup. I know I can rename the source and destination IP's to "ip" in the search and then do a lookup, but I need to be able to use the lookup fields, especially the department, related to source or destination.
Hopefully this long explanation makes sense!
