Getting Data In

connection_host = dns not working

lukasz92
Communicator

Hi,

I set new sourcetype: syslog-net for syslog events I don't want to extract host from.
My settings:

inputs.conf
[udp://55555]
connection_host = dns
disabled = 0
index = net
sourcetype = syslog-net

props.conf
[syslog-net]
MAX_TIMESTAMP_LOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False
TIME_FORMAT = %b %d %H:%M:%S
category = Operating System
maxDist = 3
pulldown_type = true
TRANSFORMS =

Problem is that it sometimes (for some IP address) doesn't work. I see reverse dns requests to DNS server, but even if there are responses, I see some IP not resolved (10.26.x.y instead of resolved host name).

Do you have any ideas?

Tags (1)
0 Karma

ronekarleone
Explorer

I have only one idea. Your sourcetype from props.conf overwrite resolved host field. You can read about it input.conf example:

* If the input is configured with a 'sourcetype' that has a transform that   overrides the 'host' field e.g. 'sourcetype=syslog', that will take precedence over the host specified here.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...