Making a lookup optional? (Or, how to build a multi-level lookup?)

Here is a the solution I came up with. (I welcome any feedback or alternate ideas.)

Here is my search:

sourcetype=my_sourcetype ip=*
[1]    | lookup local_dns ip OUTPUT hostname 
[2]    | eval clientip=if(isnull(hostname), ip, null())
[3]    | lookup dnslookup clientip OUTPUT clienthost
[4]    | eval hostname=coalesce(hostname, clienthost, ip)
[5]    | fields - clientip clienthost

Note: This search is broken in separate lines and numbered them for readability

Explication:

The goal of these search commands is to start with an ip field and "lookup" the best value for hostname using two different lookups.

Line [1] does the first lookup against a local .csv lookup file. If the lookup doesn't match then the hostname field remains missing for that event. So in [2], we assign a value to clientip only if the first lookup failed (e.g. when hostname is null). The second lookup [3] should only be preformed for events that have a value for clientip (Can anyone confirm this point?), this is the more expensive external lookup script that makes a bunch of socket.gethostbyaddr calls. So finally in [4] we can consolidate our values. We keep either hostname from the first lookup, or clienthost from the second lookup, or ip if both of the lookups failed. Then in [5] we simply remove our temporary fields.