If performance is an issue with dnslookup, which can happen when you have many distinct ips being returned by your search, you may want to populate your own lookup and refresh it nightly when there is less demand for resources. Here's a search I run nightly against a week of Windows security event log data to get the ips of machines that have been logged into, but you could substitute your own search for a list of ips to look up:
sourcetype=wineventlog:security EventCode=4768 NOT src_ip="::1"
| eval ip=replace(src_ip,"[f:]","")
| dedup ip
| lookup dnslookup clientip as ip OUTPUTNEW clienthost as hostname
| table ip, hostname
| outputlookup ip2host.csv
... View more