UDP Syslog Host Showing up as IP

Kyle_Brandt — Fri, 01 Oct 2010 19:55:55 GMT

I have set the UDP syslog port to set hostnames based on DNS. For several hosts this is working fine, however one of them shows up as the IP.

When I use dig -x to get the pointer record for the IP that is showing up from the splunk server I do get a hostname as an answer.

Any ideas as to what might be off here?

Re: UDP Syslog Host Showing up as IP

Simeon — Tue, 05 Oct 2010 00:26:25 GMT

The event itself is probably using the IP address for the Host value. It might be helpful to see what Splunk has indexed for the host value of that event, as well as what is the extracted field value. To compare, run a search similar to the following:

| metadata type=hosts | search host=<your_ip_address>
| metadata type=hosts | search host=<your_fqdn>

index=your_index source=udp:514 | fields host

The value from the metadata searches are what is stored in the index, and the values from the search with | fields is likely the extracted value.

topic Re: UDP Syslog Host Showing up as IP in Getting Data In

UDP Syslog Host Showing up as IP

Re: UDP Syslog Host Showing up as IP