Getting Data In

with inputs.conf:connection_host=dns, events are being logged where host=[ip address]. Why


I'm running version 6.0.2 on CentOS 6. My DNS servers are a pair of Windows Server 2008 domain controllers. Every month, when I patch and reboot these Windows servers - which I do sequentially, Splunk writes logs to the database where host=[ip address] instead of host=[fqdn]. This breaks my alerting because my alerts are (mostly) defined by hostnames, for examplle:
host="DC*" AND "EventCode=4740"

While the logs are being written with host=[ip address], these alerts will never trigger.

Do I need to change the order of my dns servers listed in /etc/resolv.conf prior to rebooting my DNS servers? Or should I expect splunk to seamlessly send queries to the 2nd DNS to get a response?

Does splunk perform it's own DNS queries or does it rely on the underlying OS?
If it performs its own queries, is that configurable? Will changing the order of entries in /etc/resolv.conf require restarting Splunk?

I'd prefer to fix this wholly within Splunk, and without having to restart it monthly, because it takes 15 minutes to shut down.

Tags (3)
0 Karma

Path Finder

Similar Problem here, Version 5.0.1 on Solaris my HWF is refusing connections when the first DNS server listed in /etc/resolv.conf is not available.

I had to change the order of the DNS servers and restart nscd for it to recover.

It assume the reason is a timeout in DNS resolution, this should be able to be configured.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...