In general, hostname-ip resolving with DHCP logs is like a "reference" example of Splunk time-based lookup. However...
Assuming, that (for some reason) you cannot dump and store the data required for your lookup (e.g. DHCP leases), but you can somehow perform the lookup "at the moment" (for example, by running external command like "netsh"). In this case, I believe, you should create a scripted input that will collect/receive your events, perform the lookup (and probably additional event processing routines) and return extended event records to Splunk.
Scripted inputs overview section of "Developing Views and Apps for Splunk Web" Manual could be a good starting point, I guess.
... View more