Some host's IP address not being resolved to hostname for syslog data sent to udp port 514

[coleman07]

Prior to setting connection_host to DNS for udp:514, all my hosts sending data via syslog got indexed with the host field being an IP address. After making that change, almost all of the hosts switched to having fully qualified names but 5 of those hosts continue to be indexed with an IP address instead of a fully qualified domain name.

I used the lookup command like this (note I am not using a real IP address)

host="192.168.16.12*" | rename host AS clientip | lookup dnslookup clientip

After running the command, those hosts, which continue to be indexed with host as an ip do resolve to a fully qualified name so where do I look to resolve this problem?

[yannK]

Is it syslog sourcetype, Is the source udp:514 ?

[coleman07]

The five hosts in question are source:udp:514 and sourcetype:syslog. The hosts that now do reverse lookups properly have the same source and sourcetype.

[bobmccoy]

I am having this same issue. A handful of servers resolve the correct host name and most give ip
[udp://:514]
connection_host = dns
sourcetype = syslog
disabled = 0
index = main
no_appending_timestamp = true