UDP Syslog Host Showing up as IP

[Kyle_Brandt]

I have set the UDP syslog port to set hostnames based on DNS. For several hosts this is working fine, however one of them shows up as the IP.

When I use dig -x to get the pointer record for the IP that is showing up from the splunk server I do get a hostname as an answer.

Any ideas as to what might be off here?

[Simeon]

The event itself is probably using the IP address for the Host value. It might be helpful to see what Splunk has indexed for the host value of that event, as well as what is the extracted field value. To compare, run a search similar to the following:

| metadata type=hosts | search host=<your_ip_address>
| metadata type=hosts | search host=<your_fqdn>

index=your_index source=udp:514 | fields host

The value from the metadata searches are what is stored in the index, and the values from the search with | fields is likely the extracted value.