Splunk Search

lookup hostname to ip address but output different results?



i found that when using external_lookup.py provided in $SPLUNK_HOME/etc/system/bin/, the lookup results sometimes will be different results. for example, when lookup "host.com", the results sometimes return A.B.C.D, and sometimes return E.F.G.H, does there somebody know how to fix it? thanks in advance.

Tags (1)
0 Karma


Thanks, willthames2. But what confused me is why the different results occurred within 1 minute, all i wanna do is to make sure the result is accurate when doing statistics by ip address, e.g. country. even when i open python interpreter to call socket.gethostbyname_ex(host.com), the result is always the same. so weird.

0 Karma

Path Finder

This is most likely an artifact of domain name resolution rather than anything to do with Splunk.

Asking for the IP address of host.com may well give you different values at different times, for instance if there is more than one A record associated with the domain.

What specific problems does this cause you - perhaps if we know why you need the DNS lookup to remain consistent, your problem can be solved in a different way.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...