Syslog UDP IP address to hostname

mjcocat · ‎05-15-2013

Running v5.0.2

I've added a Syslog UDP source on port 514, and enabled DNS lookup via the advanced menu. It works great for all but one of my servers. The one problem server wont translate the IP to hostname. I've verified from the Splunk server that nslookup/dig are able to correctly resolve the IP. Is there a way to either fix this or create a static transform?

mjcocat · ‎05-15-2013

I think I figured it out. The device had two IPs, both had the same hostname in DNS, I'm not sure if this caused the problem, but adding a static entry in the hosts file resolved the problem.

Syslog UDP IP address to hostname

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation

Syslog UDP IP address to hostname

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest