Merge DNS logs and IP logs

[cesca]

Hi,

I have about 40 machines sending logs to splunk via syslog. All the machines have A and PTR registers in the DNS. However, sometimes Splunk stops logging using the machine name in the host section and logs using just the IP address.

Is there any command to merge the logs with the DNS name and the logs with the IP address? What can I do to prevent it from happening again? The DNS hasn't stop working so I can't understand the reason why it happens.

Thanks a lot,

-- Xavier

[cesca]

Hi,

No answer yet? Has anyone had this problem before?