We recently have set up SPLUNK as a syslog to gather all the logs of our Cisco routers and switches. We just opened port 514 on splunk to start indexing everything.
Logs are comming in, but all devices are shown by IP address.
Now, my question is how to resolve these IP addresses too there hostname. It's not possible through DNS.
But perhaps there is an other possibility that I don't know off.
Any help or walktroughs are very welcome.
I just thought I would post in here in regards to a question I have that is related. I have heard thay you can get cisco devices to syslog and include their hostname in the syslog message.
So far I have not found out if this is correct. Does anyone have any experience with that.
I realise you can do a dnslookup, or do a lookup table, but thought if this was possible it might make more sense to apply that config change to our devices instead of splunk.
Due to our environment, we do IPs. Most of the machines [that I care about] I translate the IP to a cluster name at report time, via lookup.
There are cases when I care about who is doing what, but most of the time I want to trend who, client clusters, is hitting our clusters.