Getting Data In

IP address vs hostname

pereest
New Member

Dear Splunkers,

We recently have set up SPLUNK as a syslog to gather all the logs of our Cisco routers and switches. We just opened port 514 on splunk to start indexing everything.

Logs are comming in, but all devices are shown by IP address.

Now, my question is how to resolve these IP addresses too there hostname. It's not possible through DNS.

But perhaps there is an other possibility that I don't know off.

Any help or walktroughs are very welcome.

Kind reagrds
A follower

Tags (2)
0 Karma

CeJay
Explorer

I just thought I would post in here in regards to a question I have that is related. I have heard thay you can get cisco devices to syslog and include their hostname in the syslog message.
So far I have not found out if this is correct. Does anyone have any experience with that.

I realise you can do a dnslookup, or do a lookup table, but thought if this was possible it might make more sense to apply that config change to our devices instead of splunk.

0 Karma

Jodge
Path Finder

Michael Wilde did a blog on reverse dns lookups.

It is definitely worth a read.

http://blogs.splunk.com/2009/12/15/reverse-dns-lookups-for-host-entries/

Michael
Contributor

This just worked fantastically (v6.5).

Just be aware of what version he's referring to v.s. yours, some directories changed, but you'll get the idea...

0 Karma

BobM
Builder

You can create a lookup file or add a hosts file to your server and splunk will use either of these to get the hostname.

fk319
Builder

Due to our environment, we do IPs. Most of the machines [that I care about] I translate the IP to a cluster name at report time, via lookup.
There are cases when I care about who is doing what, but most of the time I want to trend who, client clusters, is hitting our clusters.

0 Karma

chris
Motivator

Lookup files work, if you can not use reverse DNS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...