what you are trying is not very clear then could you paste the extract of your event and more detailed explanation
for eg. There is a telnet session which takes place between two PCs in the network. Rather than having a hostname=CPU-WS2 representing that session. Is there an possibility that an IP could there instead ?
Message=A process has exited:
Image File Name:C:\WINDOWS\system32\telnet.exe
The telnet session will occur between two CPU. So isn't there an option of having IPs of both machines rather than have the name. Since identification process would far more easier and less time consuming.
yes...I downlaoded and ran universal forwarder onto two CPUs and am collecting logs from there. This is what it is showing as a result. If I search for telnet events of one CPU.
You can do this by using an external lookup script that gets the corresponding IP address from the DNS entry. There's a script that's included with Splunk as an example that does just this. More information is available here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources