Hostname returned as IP in different domain

[selspiero]

Hi

I'm having a problem with some records that are being sent from our web application - the hostname of the web server they are coming from is showing as the IP address. This has only just started to happen in the last month, and nothing has changed at the application level. Logs from servers in the same domain as the splunk indexer show correctly, but anything from our other domain only shows the IP address. Obviously this has broken alot of peoples saved searches etc - anyone seen this before? It sounds like a DNS issue, but not entirely sure where..

Latest version of Splunk on Server 2012.

[selspiero]

thanks for the reply, the web application actually forwards the logs using nlog - but just released that the problem is with reverse DNS - if i do a ping -a x.x.x.x it doesn't resolve, does for servers in the primary domain.

Will need to add reverse records to DNS i think.

[sjohnson_splunk]

Is there a Splunk forwarder installed on the web application server? When it installed it would have configured the host name into inputs.conf in the etc/system/local directory. That is the name that will get sent to the indexer as the host.

If there is no forwarder, how are you sending the logs to the Splunk indexer?

I would agree that it sounds like a DNS problem. What does an nslookup command return?