How to do looping search by lookup table

It's fairly straightforward to get something that KIND OF works. To get a list of all the IP's and domains associated with the input domain, you could do:

| inputlookup yourlookup | search [| inputlookup yourlookup | search dnsinfo_hostname="etsiunjour.fr" | fields resolved_IP] | stats values(dnsinfo_hostname) by resolved_IP

This will first of all run a subsearch that gets all IP's associated with the "etsiunjour.fr" domain in the lookup, then once again check the lookup which domains are associated with those IP's. The output will be the resolved IP's and a list of associated domains for each.

Moving on from that, there are a number of tricky things that need to be solved in order to get the exact format you're looking for. You need to find the domains that are NOT the input domain, and add them to a comma separated list that is then put within parantheses after the IP number. Finally, all these IP's including any extra info should be put into a multivalued field. After messing around a bit, I came up with the following search that should do what you want:

| inputlookup dns.csv
| search
  [| inputlookup dns.csv 
   | search dnsinfo_hostname="etsiunjour.fr" | fields resolved_IP ]
| mvcombine dnsinfo_hostname
| eval resolved_IP=if(mvcount(dnsinfo_hostname)>1,resolved_IP+"("+mvjoin(mvfilter(NOT match(dnsinfo_hostname,"etsiunjour.fr")),",")+")",resolved_IP)
| eval dnsinfo_hostname="etsiunjour.fr"
| mvcombine resolved_IP

While I can't say it looks pretty, it does work and shows some of the flexibility you get with Splunk's search language. :)

Note that the input domain ("etsiunjour.fr") is used in three places in the search. This is because once the initial resolving and reverse resolving is done, it's hard to know what the original input domain was. The easiest would be to implement this search as a macro, or in a form that can just refer to the input domain as a variable name.

I wouldn't use the map command, it is a very expensive command to use in terms of search processing. Try this one:

sourcetype=YOURSOURCETYPE index=*| lookup YOURFILE.csv dnsinfo_hostname OUTPUT resolved_IP|stats values(dnsinfo_hostname) as original_hostname by resolved_IP|lookup YOURFILE.csv resolved_IP OUTPUT dnsinfo_hostname