Splunk Search

Why does using the same lookup table on two input fields returns NONE?

splunklearner12
Path Finder

Hello, I have data with internal and external IP addresses. Every event has either an internal source or destination IP. For all internal IP addresses, I have prior created a lookup table with ip, ip_resolved and the department which is taken from part of the host name (this lookup should prevent having to do too many dns lookups at search time and gets updated every day). The ip_resolved field is the resolved DNS Name using Splunk's external_lookup.py script, and in cases where no DNS name is found, ip_resolved and department are successfully fillnulled with the value "not found".
Now, when I set up an automatic lookup for each the source and destination ip, about 15% of the results for ip_resolved are the value NONE, which is the default value for my lookup definition. If I make sure that I filter my search to only show events where the destination IP is internal, no NONE values are returned (but some "not found", as expected). I think it's maybe because destination comes before source alphabetically, and Splunk does that lookup first which then breaks the source lookup. I know I can rename the source and destination IP's to "ip" in the search and then do a lookup, but I need to be able to use the lookup fields, especially the department, related to source or destination.
Hopefully this long explanation makes sense!

0 Karma
1 Solution

splunklearner12
Path Finder

Okay, I have already figured it out myself - I had to change the minimum results in my host lookup definition to 0 instead of 1! That's all. I hope this can help someone else and does not just waste everyone's time having to read this post!

View solution in original post

0 Karma

splunklearner12
Path Finder

Okay, I have already figured it out myself - I had to change the minimum results in my host lookup definition to 0 instead of 1! That's all. I hope this can help someone else and does not just waste everyone's time having to read this post!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...