We currently have many systems with names that are meaningless to anyone other than sysadmins, but they have important CNAMEs associated with them that make much more sense to developers who use Splunk for debugging purposes.
For example, we might have a server named "saturn", which logs as such in Splunk and is quick and easy for sysadmins to use for troubleshooting. But the developers refer to it as "prod-live-db-0", which is a DNS CNAME for "saturn".
Is there a way to have Splunk do a DNS lookup on a CNAME and translate it back to the actual server name when doing a search? So if the user searches: host="prod-live-db-0" it will return all messages relevant to host="saturn" (and do this using DNS, i.e., not requiring us to statically define the values in Splunk itself)?
... View more