topic Universal Forwarder DNS resolution in Getting Data In

Universal Forwarder DNS resolution

a_naoum — Tue, 08 Oct 2019 07:50:27 GMT

Good day to all,

Since I didn't find an search results on this topic, does UF do any DNS resolution for the events (windows or whatsoever) that reads ?

I believe that doesn't do but I would like some second opinion.

thanks!

Re: Universal Forwarder DNS resolution

gcusello — Tue, 08 Oct 2019 09:45:25 GMT

Hi a_naoum,
I know that Universal Forwarder connects to DNS for resolution, because in some past versions (6.x) of the Windows UF there was a bug so, sometimes, the memory use was too high and the solution suggested by the Splunk Support was to disable DNS resolution.
I cannot explain more details.

Bye.
Giuseppe

Re: Universal Forwarder DNS resolution

gfreitas — Tue, 08 Oct 2019 10:40:33 GMT

The answer here will depend on your configuration but the UF should index the raw data it sees unless state otherwise on the configuration (for example on props and transforms to change it, but this would be done on the Indexer(s)/HF(s).