topic Re: Splunk does not resolve hostnames in rDNS in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-resolve-hostnames-in-rDNS/m-p/47314#M8985 <P>Hi Torgeirarnoy,</P> <P>This would be the point you dive into the config files, specifically the <STRONG>inputs.conf</STRONG> where you have specified the UDP:514 input. You'll need to change the default 'connection_host' value (ip) to (dns).</P> <PRE><CODE>[udp://514] connection_host = dns sourcetype = syslog </CODE></PRE> <P>REF: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Inputsconf</A></P> <P>Hope this helps!</P> Tue, 27 Aug 2013 10:19:52 GMT rturk 2013-08-27T10:19:52Z Splunk does not resolve hostnames in rDNS https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-resolve-hostnames-in-rDNS/m-p/47313#M8984 <P>Hi,</P> <P>We have a fairly new install of Splunk 5.0.4, and i've now opened UDP:514 and the syslog is flowing in. The problem tho is that Splunk lists the hosts with theyr source IP adress instead of the real hostname.</P> <P>The IPs are all resolveable in rDNS on the splunk server. I cant really find anything reasonable for this case in the manager section either.</P> <P>What can cause this?</P> Tue, 27 Aug 2013 09:57:23 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-resolve-hostnames-in-rDNS/m-p/47313#M8984 torgeirarnoy 2013-08-27T09:57:23Z Re: Splunk does not resolve hostnames in rDNS https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-resolve-hostnames-in-rDNS/m-p/47314#M8985 <P>Hi Torgeirarnoy,</P> <P>This would be the point you dive into the config files, specifically the <STRONG>inputs.conf</STRONG> where you have specified the UDP:514 input. You'll need to change the default 'connection_host' value (ip) to (dns).</P> <PRE><CODE>[udp://514] connection_host = dns sourcetype = syslog </CODE></PRE> <P>REF: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Inputsconf</A></P> <P>Hope this helps!</P> Tue, 27 Aug 2013 10:19:52 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-resolve-hostnames-in-rDNS/m-p/47314#M8985 rturk 2013-08-27T10:19:52Z Re: Splunk does not resolve hostnames in rDNS https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-resolve-hostnames-in-rDNS/m-p/47315#M8986 <P>Worked perfectly. Thanks alot</P> Tue, 27 Aug 2013 10:53:26 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-does-not-resolve-hostnames-in-rDNS/m-p/47315#M8986 torgeirarnoy 2013-08-27T10:53:26Z