Below is the only line in my props.conf file and when i do the search it still won't perform the lookup. Also, i get errors now on any search that i do. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf '(?i)source::....zip(.\d+)?' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'ActiveDirectory' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'Cisco:ISE:Syslog' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'F5:AFM:Syslog' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'F5:LTM:Access' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'F5:LTM:DCFW' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'F5:LTM:Syslog' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'F5:iRule:WebAccess' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'F5_SPLUNK_iRULE' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'PerformanceMonitor' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'Splunk_TA_cisco-ise-too_small' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'Splunk_TA_f5_bigip_main.log' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'Splunk_TA_f5_bigip_main.log-too_small' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'WinNetMonMk' and lookup table 'dnsLookup'. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'WinPrintMon' and lookup table 'dnsLookup'. ============================== props.conf LOOKUP-rdns = dnsLookup clientip AS host OUTPUTNEW clienthost AS hostname ... View more

Also, I don't have a hostname field. The only fields I have in my stats view are distinct view and client_ip. ... View more

Tried your search and that didn't work. ... View more

Mreynov, The link you provided is where I first got the information to edit my props.conf and transforms.conf files with the details I listed above. Keep in mind that the field i'm trying to do the reverse lookup on is called "client_ip" so does that matter at all? Here is my full search... sourcetype="F5:iRule:WebAccess" NOT uat. cipher=TLSv1 | stats dc(client_ip) as distinctCount values(client_ip) | where distinctCount>1 | lookup dnsLookup ip AS clientip OUTPUTNEW host AS hostname So far this search only shows me the distinct IPs (as it should) but it doesn't resolve those IPs. ... View more

I'm trying do a reverse DNS lookup in splunk and i'm also having some issues. I have the following in my props.conf file... [access_combined] LOOKUP-rdns = dnsLookup ip AS clientip OUTPUTNEW host AS hostname I think the problem may be that the field that i'm trying to do the reverse lookup on isn't called ip or clientip, it's called client_ip. My transforms.conf looks like this: [dnsLookup] external_cmd = external_lookup.py host ip fields_list = host, ip Just looking for some direction here. I've been unable to get a reverse lookup to work so far. Thanks ... View more