Getting Data In

IP address vs hostname

New Member

Dear Splunkers,

We recently have set up SPLUNK as a syslog to gather all the logs of our Cisco routers and switches. We just opened port 514 on splunk to start indexing everything.

Logs are comming in, but all devices are shown by IP address.

Now, my question is how to resolve these IP addresses too there hostname. It's not possible through DNS.

But perhaps there is an other possibility that I don't know off.

Any help or walktroughs are very welcome.

Kind reagrds
A follower

Tags (2)
0 Karma


I just thought I would post in here in regards to a question I have that is related. I have heard thay you can get cisco devices to syslog and include their hostname in the syslog message.
So far I have not found out if this is correct. Does anyone have any experience with that.

I realise you can do a dnslookup, or do a lookup table, but thought if this was possible it might make more sense to apply that config change to our devices instead of splunk.

0 Karma

Path Finder

Michael Wilde did a blog on reverse dns lookups.

It is definitely worth a read.


This just worked fantastically (v6.5).

Just be aware of what version he's referring to v.s. yours, some directories changed, but you'll get the idea...

0 Karma


You can create a lookup file or add a hosts file to your server and splunk will use either of these to get the hostname.


Due to our environment, we do IPs. Most of the machines [that I care about] I translate the IP to a cluster name at report time, via lookup.
There are cases when I care about who is doing what, but most of the time I want to trend who, client clusters, is hitting our clusters.

0 Karma


Lookup files work, if you can not use reverse DNS

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...