topic Re: IP address vs hostname in Getting Data In

IP address vs hostname

pereest — Wed, 20 Jul 2011 11:51:47 GMT

Dear Splunkers,

We recently have set up SPLUNK as a syslog to gather all the logs of our Cisco routers and switches. We just opened port 514 on splunk to start indexing everything.

Logs are comming in, but all devices are shown by IP address.

Now, my question is how to resolve these IP addresses too there hostname. It's not possible through DNS.

But perhaps there is an other possibility that I don't know off.

Any help or walktroughs are very welcome.

Kind reagrds
A follower

Re: IP address vs hostname

BobM — Wed, 20 Jul 2011 12:36:02 GMT

You can create a lookup file or add a hosts file to your server and splunk will use either of these to get the hostname.

Re: IP address vs hostname

Jodge — Wed, 20 Jul 2011 13:00:55 GMT

Michael Wilde did a blog on reverse dns lookups.

It is definitely worth a read.

http://blogs.splunk.com/2009/12/15/reverse-dns-lookups-for-host-entries/

Re: IP address vs hostname

chris — Wed, 20 Jul 2011 13:25:03 GMT

Lookup files work, if you can not use reverse DNS

Re: IP address vs hostname

fk319 — Wed, 20 Jul 2011 15:27:49 GMT

Due to our environment, we do IPs. Most of the machines [that I care about] I translate the IP to a cluster name at report time, via lookup.
There are cases when I care about who is doing what, but most of the time I want to trend who, client clusters, is hitting our clusters.

Re: IP address vs hostname

CeJay — Tue, 02 Jul 2013 01:13:12 GMT

I just thought I would post in here in regards to a question I have that is related. I have heard thay you can get cisco devices to syslog and include their hostname in the syslog message.
So far I have not found out if this is correct. Does anyone have any experience with that.

I realise you can do a dnslookup, or do a lookup table, but thought if this was possible it might make more sense to apply that config change to our devices instead of splunk.

Re: IP address vs hostname

Michael — Thu, 17 Nov 2016 16:20:37 GMT

This just worked fantastically (v6.5).

Just be aware of what version he's referring to v.s. yours, some directories changed, but you'll get the idea...