https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640543#M109331 <P>Hi,<BR /><BR />I have a zscaler NSS connected to splunk. I've been running some tests to see how splunk reacts to change in DNS entries.&nbsp;<BR />It seems that the hostname isnt changed in splunk. Can anyone help me on this?<span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="DNS splunk 1.PNG" style="width: 200px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24973i7A4FC406EA15A721/image-size/small?v=v2&amp;px=200" role="button" title="DNS splunk 1.PNG" alt="DNS splunk 1.PNG" /></span><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="DNS splunk 2.PNG" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24974i9259A1ECD2E0A9E6/image-size/medium?v=v2&amp;px=400" role="button" title="DNS splunk 2.PNG" alt="DNS splunk 2.PNG" /></span></P> <P>nssem1.clab.group is the old name.<BR /><BR />Thanks!&nbsp;</P> Wed, 19 Apr 2023 21:37:09 GMT sarashafek 2023-04-19T21:37:09Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640543#M109331 <P>Hi,<BR /><BR />I have a zscaler NSS connected to splunk. I've been running some tests to see how splunk reacts to change in DNS entries.&nbsp;<BR />It seems that the hostname isnt changed in splunk. Can anyone help me on this?<span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="DNS splunk 1.PNG" style="width: 200px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24973i7A4FC406EA15A721/image-size/small?v=v2&amp;px=200" role="button" title="DNS splunk 1.PNG" alt="DNS splunk 1.PNG" /></span><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="DNS splunk 2.PNG" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/24974i9259A1ECD2E0A9E6/image-size/medium?v=v2&amp;px=400" role="button" title="DNS splunk 2.PNG" alt="DNS splunk 2.PNG" /></span></P> <P>nssem1.clab.group is the old name.<BR /><BR />Thanks!&nbsp;</P> Wed, 19 Apr 2023 21:37:09 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640543#M109331 sarashafek 2023-04-19T21:37:09Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640833#M109341 <P>Splunk doesn't necessarily get its hostname from DNS.&nbsp; It can be hardcoded in inputs.conf (<FONT face="courier new,courier">host=foo</FONT>) or server.conf (<FONT face="courier new,courier">serverName=foo</FONT>).&nbsp; &nbsp; There's also the&nbsp;<FONT face="courier new,courier">hostnameOption&nbsp;</FONT>in server.conf which determines if DNS is consulted, but only applies on Windows.</P> Thu, 20 Apr 2023 13:11:23 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640833#M109341 richgalloway 2023-04-20T13:11:23Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640850#M109342 <P>It could also define so that when UF process start, it determine what is hostname at this time. Then it could be almost anything from localhost to fqdn. Actually splunk knowns hosts by GUID not by hostname.</P> Thu, 20 Apr 2023 15:17:12 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640850#M109342 isoutamo 2023-04-20T15:17:12Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640934#M109345 <P>Your best bet is to use the IP and then do DNS lookup at search time with:<BR />... | lookup dnslookup clientip AS host ...</P> Fri, 21 Apr 2023 00:24:39 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-showing-wrong-hostname/m-p/640934#M109345 woodcock 2023-04-21T00:24:39Z