IP address vs hostname

[pereest]

Dear Splunkers,

We recently have set up SPLUNK as a syslog to gather all the logs of our Cisco routers and switches. We just opened port 514 on splunk to start indexing everything.

Logs are comming in, but all devices are shown by IP address.

Now, my question is how to resolve these IP addresses too there hostname. It's not possible through DNS.

But perhaps there is an other possibility that I don't know off.

Any help or walktroughs are very welcome.

Kind reagrds
A follower

[CeJay]

I just thought I would post in here in regards to a question I have that is related. I have heard thay you can get cisco devices to syslog and include their hostname in the syslog message.
So far I have not found out if this is correct. Does anyone have any experience with that.

I realise you can do a dnslookup, or do a lookup table, but thought if this was possible it might make more sense to apply that config change to our devices instead of splunk.

[Jodge]

Michael Wilde did a blog on reverse dns lookups.

It is definitely worth a read.

http://blogs.splunk.com/2009/12/15/reverse-dns-lookups-for-host-entries/

[Michael]

This just worked fantastically (v6.5).

Just be aware of what version he's referring to v.s. yours, some directories changed, but you'll get the idea...

[BobM]

You can create a lookup file or add a hosts file to your server and splunk will use either of these to get the hostname.

[fk319]

Due to our environment, we do IPs. Most of the machines [that I care about] I translate the IP to a cluster name at report time, via lookup.
There are cases when I care about who is doing what, but most of the time I want to trend who, client clusters, is hitting our clusters.

[chris]

Lookup files work, if you can not use reverse DNS