Getting Data In

How to put FQDN in syslog input instead of IP address?

lguinn2
Legend

I am indexing a file of aggregated syslog events. The events in the file contain the IP addresses of the various hosts.

If I could input this data as a network input (TCP or UDP), I would be able to use the DNS setting on the input, and Splunk would do a reverse DNS lookup on the IPs as the events arrived. But that is not an option in this case.

I do want to index this file using the FQDN of the hosts, rather than the IP addresses. This would be more consistent with my other inputs, and I believe it would be more efficient than running external_lookup.py all the time.

Is this possible with Splunk 4.1.x?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes. I'm assuming you're using Splunk UDP input. If you're using a syslog server and Splunking in the resulting file, you should set up the syslog server to do the lookup when it writes to the file. With a Splunk UDP input add:

connection_host = dns

to the input stanza for the UDP input in inputs.conf.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Yes. I'm assuming you're using Splunk UDP input. If you're using a syslog server and Splunking in the resulting file, you should set up the syslog server to do the lookup when it writes to the file. With a Splunk UDP input add:

connection_host = dns

to the input stanza for the UDP input in inputs.conf.

NetFlow_Logic
Contributor

Our customers are asking about resolving IP addresses to FQDN in Splunk. Are there any development in this area in Splunk since 2010?

lguinn2
Legend

I am not using UDP, but this still answered my question. I need to set up the syslog server to do the DNS lookup.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...