We have updated our Terms of Service, Code of Conduct, and Addendum.

Looking to enrich my data by doing a reverse ip lookup and setting that as the source

Options

Hello, total noob looking for some help. I installed edge/stream on Rocky 8. It is running, but I am having trouble figuring out how to manipulate data in a source. The source is syslogng, destination is splunk. I want to take the data from the source, do a reverse lookup of the IP that sent the data, then replace the system name or add a field with the result from the reverse lookup. The reasoning behind this is that the syslog senders are part of a virtualization cluster, but each cluster re-uses the name(s) "node(X)" internally, so within splunk there's duplicate entries from each cluster. A reverse lookup should give us unique names for splunk

Answers