Getting Data In

UDP Syslog Host Showing up as IP

Path Finder

I have set the UDP syslog port to set hostnames based on DNS. For several hosts this is working fine, however one of them shows up as the IP.

When I use dig -x to get the pointer record for the IP that is showing up from the splunk server I do get a hostname as an answer.

Any ideas as to what might be off here?

Tags (3)
0 Karma

Splunk Employee
Splunk Employee

The event itself is probably using the IP address for the Host value. It might be helpful to see what Splunk has indexed for the host value of that event, as well as what is the extracted field value. To compare, run a search similar to the following:

| metadata type=hosts | search host=<your_ip_address>
| metadata type=hosts | search host=<your_fqdn>

index=your_index source=udp:514 | fields host

The value from the metadata searches are what is stored in the index, and the values from the search with | fields is likely the extracted value.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!