Getting Data In

Syslog UDP IP address to hostname

mjcocat
New Member

Running v5.0.2

I've added a Syslog UDP source on port 514, and enabled DNS lookup via the advanced menu. It works great for all but one of my servers. The one problem server wont translate the IP to hostname. I've verified from the Splunk server that nslookup/dig are able to correctly resolve the IP. Is there a way to either fix this or create a static transform?

Tags (1)
0 Karma

mjcocat
New Member

I think I figured it out. The device had two IPs, both had the same hostname in DNS, I'm not sure if this caused the problem, but adding a static entry in the hosts file resolved the problem.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...