I got this error when I configure an automathic lookup:
Could not find all of the specified lookup fields in the lookup table
I tried the script and runs perfectly
I created a partial CSV file and execute it with the python srcript:
/opt/splunk/bin/splunk cmd python /opt/splunk/etc/system/bin/external_lookup.py host ip < temp.csv
host,ip
www.hardware.fr,83.243.20.80
www.bash.org,69.61.106.93
www.somafm.com,64.147.167.20
Then I configured the trasnforms.conf:
and the props.conf:
[mydnslookup]
external_cmd = external_lookup.py host ip
external_type = python
fields_list = dst_ip, dst_hostname
[pan_traffic]
LOOKUP-rdns = mydnslookup ip AS dst_ip OUTPUT host AS resolved_host
also I tried:
[pan_traffic]
LOOKUP-rdns = mydnslookup clientip AS dst_ip OUTPUT host AS resolved_host
I used this tutorial:
http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_an_external_command_or_script
... View more