I've added a Syslog UDP source on port 514, and enabled DNS lookup via the advanced menu. It works great for all but one of my servers. The one problem server wont translate the IP to hostname. I've verified from the Splunk server that nslookup/dig are able to correctly resolve the IP. Is there a way to either fix this or create a static transform?
I think I figured it out. The device had two IPs, both had the same hostname in DNS, I'm not sure if this caused the problem, but adding a static entry in the hosts file resolved the problem.
