Getting Data In

Splunk does not resolve hostnames in rDNS

torgeirarnoy
Engager

Hi,

We have a fairly new install of Splunk 5.0.4, and i've now opened UDP:514 and the syslog is flowing in. The problem tho is that Splunk lists the hosts with theyr source IP adress instead of the real hostname.

The IPs are all resolveable in rDNS on the splunk server. I cant really find anything reasonable for this case in the manager section either.

What can cause this?

Tags (3)
0 Karma
1 Solution

rturk
Builder

Hi Torgeirarnoy,

This would be the point you dive into the config files, specifically the inputs.conf where you have specified the UDP:514 input. You'll need to change the default 'connection_host' value (ip) to (dns).

[udp://514]
connection_host = dns
sourcetype = syslog

REF: http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Inputsconf

Hope this helps!

View solution in original post

rturk
Builder

Hi Torgeirarnoy,

This would be the point you dive into the config files, specifically the inputs.conf where you have specified the UDP:514 input. You'll need to change the default 'connection_host' value (ip) to (dns).

[udp://514]
connection_host = dns
sourcetype = syslog

REF: http://docs.splunk.com/Documentation/Splunk/5.0.4/admin/Inputsconf

Hope this helps!

torgeirarnoy
Engager

Worked perfectly. Thanks alot

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...