Getting Data In

Universal Forwarder DNS resolution

Path Finder

Good day to all,

Since I didn't find an search results on this topic, does UF do any DNS resolution for the events (windows or whatsoever) that reads ?

I believe that doesn't do but I would like some second opinion.


0 Karma


The answer here will depend on your configuration but the UF should index the raw data it sees unless state otherwise on the configuration (for example on props and transforms to change it, but this would be done on the Indexer(s)/HF(s).

0 Karma


Hi a_naoum,
I know that Universal Forwarder connects to DNS for resolution, because in some past versions (6.x) of the Windows UF there was a bug so, sometimes, the memory use was too high and the solution suggested by the Splunk Support was to disable DNS resolution.
I cannot explain more details.


0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!