There, I fixed it. Case of RTFM, and proper field names. Also sorted the columns. Nice.
host="192.168.x.x" | lookup dnslookup clientip as DST OUTPUT clienthost as DST_RESOLVED | lookup dnslookup clientip as SRC OUTPUT clienthost as SRC_RESOLVED | Table _time SRC SRC_RESOLVED DST DST_RESOLVED PROTO DPT
Digging in Netfilter-Iptables after this.
... View more