Splunk Search

data sent via syslog aren't resolving their host name

BSoni
New Member

The servers sending data via syslog aren't resolving their host name....I edited my inputs.conf file in local dir as suggested. when i do search on splunk by sourcetype=syslog; i see bunch of ip address for host. please kindly offer some advise what am i doing wrong.

[udp://514]

disabled = false

connection_host = dns

Thanks,

Soni

Tags (1)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

By default, for sourcetype=syslog, the host field will be extracted by regex from the event itself, which overwrites the host from the connection (that's set by this connection_host directive).

The easiest way to defeat this behavior is to choose a sourcetype other than syslog.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...