https://community.splunk.com/t5/Splunk-Search/Some-hosts-come-in-as-IP-some-as-hostname-easy-way-to-make/m-p/182929#M52670 <P>Best approach will be have your forwarder configured to send in one format. If its not easy, then you can use dns lookup feature in splunk to convert all to one type, either hostname or IP, up to you. For reference see this: <A href="http://answers.splunk.com/answers/8051/dns-lookup-via-splunk">http://answers.splunk.com/answers/8051/dns-lookup-via-splunk</A></P> Wed, 18 Dec 2013 12:34:07 GMT somesoni2 2013-12-18T12:34:07Z https://community.splunk.com/t5/Splunk-Search/Some-hosts-come-in-as-IP-some-as-hostname-easy-way-to-make/m-p/182928#M52669 <P>Hey, So we have a few hundred hosts coming in, some come in as dns hostname, some come in as IP address.</P> <P>What is the best practice for dealing with this? Make everything IP or hostname?</P> <P>Is it possible to add an IP and hostname to all these records via some lookup? Or should I 'decide' on either hostnames or IP addresses and try to get everything set the same?</P> <P>Thanks,<BR /> Pierce</P> Wed, 18 Dec 2013 11:40:59 GMT https://community.splunk.com/t5/Splunk-Search/Some-hosts-come-in-as-IP-some-as-hostname-easy-way-to-make/m-p/182928#M52669 Pierceyuk 2013-12-18T11:40:59Z https://community.splunk.com/t5/Splunk-Search/Some-hosts-come-in-as-IP-some-as-hostname-easy-way-to-make/m-p/182929#M52670 <P>Best approach will be have your forwarder configured to send in one format. If its not easy, then you can use dns lookup feature in splunk to convert all to one type, either hostname or IP, up to you. For reference see this: <A href="http://answers.splunk.com/answers/8051/dns-lookup-via-splunk">http://answers.splunk.com/answers/8051/dns-lookup-via-splunk</A></P> Wed, 18 Dec 2013 12:34:07 GMT https://community.splunk.com/t5/Splunk-Search/Some-hosts-come-in-as-IP-some-as-hostname-easy-way-to-make/m-p/182929#M52670 somesoni2 2013-12-18T12:34:07Z