DNS lookup not happening with TCP syslog

[cbalmer]

I have a lot of Cisco equipment sending syslog data to my Splunk server. Some of this equipment is using TCP (ones with packet loss in the path) and others are using UDP.

The systems sending via UDP have no issues. Splunk looks up their hostname with reverse DNS of the source IP and enters the data under the correct host.

However any system sending via TCP does not get the same treatment. Splunk does not do reverse DNS and instead enters it under the host of the IP address. If I switch one of these systems to UDP, Splunk correctly does reverse DNS and those entries show up under the hostname and not the IP. Switch the system back to TCP and the entries go under the IP again.

Here are the inputs.conf entries for both:

# cat apps/launcher/local/inputs.conf 
[udp://514]
connection_host = dns
sourcetype = syslog

[tcp://514]
connection_host = dns
sourcetype = syslog
disabled = 0

How can I get reverse DNS functioning for syslog running over TCP?

[tvaniderstine]

Its been 5 years. can someone from Splunk answer this one, since its still a problem.

[dkuk]

Hi,
Did you manage it resolve this (I appreciate it was a while back).