I just moved my Splunk indexer from one server to another. A few bumps in the road, but everything seems to be working now, except for that fact that two hosts will not resolve in DNS, so Splunk is indexing them as IP addresses instead. They are located on a different network than the Splunk indexer, but they still resolve in DNS. Old server was running CentOS, new server is running Ubuntu 18.04. All other hosts that I index run Splunk universal forwarder, and when those logs make it to my indexer, they are already coming in with hostnames and not IPs.
The traffic is coming on typical udp/514, one from a cisco ASA, the other from a Cisco Switch. Prior to moving the Splunk instance, hostnames resolved fine. The DNS server is the same as it was before.
They resolve fine with nslookup:
[root@splunk ~]$ nslookup 192.168.50.2
2.50.168.192.in-addr.arpa name = Switch.
Authoritative answers can be found from:
[root@splunk ~]$ nslookup 192.168.10.50
50.10.168.192.in-addr.arpa name = CiscoASA.
Authoritative answers can be found from:
Any idea why these wouldn't resolve with Splunk indexer?
