Getting Data In

Why is DNS lookup failing during indexing for 2 hosts?

Path Finder

I just moved my Splunk indexer from one server to another. A few bumps in the road, but everything seems to be working now, except for that fact that two hosts will not resolve in DNS, so Splunk is indexing them as IP addresses instead. They are located on a different network than the Splunk indexer, but they still resolve in DNS. Old server was running CentOS, new server is running Ubuntu 18.04. All other hosts that I index run Splunk universal forwarder, and when those logs make it to my indexer, they are already coming in with hostnames and not IPs.

The traffic is coming on typical udp/514, one from a cisco ASA, the other from a Cisco Switch. Prior to moving the Splunk instance, hostnames resolved fine. The DNS server is the same as it was before.

They resolve fine with nslookup:

[root@splunk ~]$ nslookup       name = Switch.

Authoritative answers can be found from:

[root@splunk ~]$ nslookup      name = CiscoASA.

Authoritative answers can be found from:

alt text

Any idea why these wouldn't resolve with Splunk indexer?

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...