https://community.splunk.com/t5/Getting-Data-In/Do-Splunk-inputs-dedicated-to-universal-forwarders-need-reverse/m-p/112041#M23478 <P>We have around 230 PCs servers spelunking to a single splunk server across a firewall.</P> <P>Many of these clients are not logging data and show connection and timeout errors in splunkd log etc. After some research I have seen suggestions that incorrectly configured reverse DNS may be a cause.</P> <P>Simple question is do the splunk inputs dedicated to universal forwarders need configuration regarding DNS? I thought that the hostname was provided by the splunk forwarder config files rather than DNS.</P> <P>Am I confusing other inputs with which need this?<BR /> Any advice gratefully received.</P> Thu, 04 Sep 2014 18:17:07 GMT vptltd 2014-09-04T18:17:07Z https://community.splunk.com/t5/Getting-Data-In/Do-Splunk-inputs-dedicated-to-universal-forwarders-need-reverse/m-p/112041#M23478 <P>We have around 230 PCs servers spelunking to a single splunk server across a firewall.</P> <P>Many of these clients are not logging data and show connection and timeout errors in splunkd log etc. After some research I have seen suggestions that incorrectly configured reverse DNS may be a cause.</P> <P>Simple question is do the splunk inputs dedicated to universal forwarders need configuration regarding DNS? I thought that the hostname was provided by the splunk forwarder config files rather than DNS.</P> <P>Am I confusing other inputs with which need this?<BR /> Any advice gratefully received.</P> Thu, 04 Sep 2014 18:17:07 GMT https://community.splunk.com/t5/Getting-Data-In/Do-Splunk-inputs-dedicated-to-universal-forwarders-need-reverse/m-p/112041#M23478 vptltd 2014-09-04T18:17:07Z https://community.splunk.com/t5/Getting-Data-In/Do-Splunk-inputs-dedicated-to-universal-forwarders-need-reverse/m-p/112042#M23479 <P>Managed to resolve this with the help of tech support and solution is below in case others find it useful.</P> <P>Reverse DNS lookups were indeed the issue. When creating the splunk forwarder input, the default "connection_host" (inputs.conf) is to use reverse dns. In our case no dns/access via firewall was possible to multiple timouts/net traffic generated which was stopping other clients connecting reliably.</P> <P>Edited the input to "connection_host" to "none", restarted splunk and all was well with no further connection timeouts in splunkd.log etc.</P> Mon, 08 Sep 2014 14:59:29 GMT https://community.splunk.com/t5/Getting-Data-In/Do-Splunk-inputs-dedicated-to-universal-forwarders-need-reverse/m-p/112042#M23479 vptltd 2014-09-08T14:59:29Z