This should help.
http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources
Here's an example of how you might use external lookups to match with information from a DNS server. Splunk ships with a script located in $SPLUNK_HOME/etc/system/bin/ called external_lookup.py, which is a DNS lookup script that:
if given a host, returns the IP address.
if given an IP address, returns the host name.
In a transforms.conf file, put:
[dnsLookup]
external_cmd = external_lookup.py host ip
fields_list = host, ip
In a props.conf file, put:
[access_combined]
LOOKUP-dns = dnsLookup host OUTPUT ip AS clientip
The field in the lookup table is named ip, but Splunk automatically extracts the IP addresses from Web access logs into a field named clientip. So, "OUTPUT ip AS clientip" indicates that you want Splunk to add the values of ip from the lookup table into the clientip field in the events. Since the host field has the same name in the lookup table and the events, you don't need to rename the field.
For a reverse DNS lookup, your props.conf stanza would be:
[access_combined]
LOOKUP-rdns = dnsLookup ip AS clientip OUTPUTNEW host AS hostname
For this example, instead of overwriting the host field value, you want Splunk to return the host value in a new field, called hostname
Restart Splunk.
Previous questions asked on this:
http://splunk-base.splunk.com/answers/30075/dns-lookup-failing
http://splunk-base.splunk.com/answers/8051/dns-lookup-via-splunk
... View more
