https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97882#M20418 <P>Yes. I'm assuming you're using Splunk UDP input. If you're using a syslog server and Splunking in the resulting file, you should set up the syslog server to do the lookup when it writes to the file. With a Splunk UDP input add:</P> <PRE><CODE>connection_host = dns </CODE></PRE> <P>to the input stanza for the UDP input in inputs.conf.</P> Thu, 02 Dec 2010 07:41:02 GMT gkanapathy 2010-12-02T07:41:02Z https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97881#M20417 <P>I am indexing a file of aggregated syslog events. The events in the file contain the IP addresses of the various hosts.</P> <P>If I could input this data as a network input (TCP or UDP), I would be able to use the DNS setting on the input, and Splunk would do a reverse DNS lookup on the IPs as the events arrived. But that is not an option in this case.</P> <P>I do want to index this file using the FQDN of the hosts, rather than the IP addresses. This would be more consistent with my other inputs, and I believe it would be more efficient than running external_lookup.py all the time.</P> <P>Is this possible with Splunk 4.1.x?</P> Thu, 02 Dec 2010 07:28:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97881#M20417 lguinn2 2010-12-02T07:28:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97882#M20418 <P>Yes. I'm assuming you're using Splunk UDP input. If you're using a syslog server and Splunking in the resulting file, you should set up the syslog server to do the lookup when it writes to the file. With a Splunk UDP input add:</P> <PRE><CODE>connection_host = dns </CODE></PRE> <P>to the input stanza for the UDP input in inputs.conf.</P> Thu, 02 Dec 2010 07:41:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97882#M20418 gkanapathy 2010-12-02T07:41:02Z https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97883#M20419 <P>I am not using UDP, but this still answered my question. I need to set up the syslog server to do the DNS lookup.</P> Fri, 10 Dec 2010 04:53:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97883#M20419 lguinn2 2010-12-10T04:53:18Z https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97884#M20420 <P>Our customers are asking about resolving IP addresses to FQDN in Splunk. Are there any development in this area in Splunk since 2010?</P> Tue, 28 May 2013 00:58:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-put-FQDN-in-syslog-input-instead-of-IP-address/m-p/97884#M20420 NetFlow_Logic 2013-05-28T00:58:14Z