lookup hostname to ip address but output different results?

[hjwang]

Hi~there

i found that when using external_lookup.py provided in $SPLUNK_HOME/etc/system/bin/, the lookup results sometimes will be different results. for example, when lookup "host.com", the results sometimes return A.B.C.D, and sometimes return E.F.G.H, does there somebody know how to fix it? thanks in advance.

[hjwang]

Thanks, willthames2. But what confused me is why the different results occurred within 1 minute, all i wanna do is to make sure the result is accurate when doing statistics by ip address, e.g. country. even when i open python interpreter to call socket.gethostbyname_ex(host.com), the result is always the same. so weird.

[willthames2]

This is most likely an artifact of domain name resolution rather than anything to do with Splunk.

Asking for the IP address of host.com may well give you different values at different times, for instance if there is more than one A record associated with the domain.

What specific problems does this cause you - perhaps if we know why you need the DNS lookup to remain consistent, your problem can be solved in a different way.