Host shows as $decideOnStartup in website monitoring 2.9

[afx]

Hi,
I just started to use 2.9 and wanted to check out the new header/body feature.
While doing so I discovered that host for all entries is set to $decideOnStartup while looking at the web monitoring index.
Am I doing somthing wrong?

thx
afx

[afx · Accepted solution]

Started to set up a website via the GUI and advanced options instead of the inputs.conf file of the app.
Found a host setting there that said $decideOnStartup.

So one explicitly needs to set up the host, it is not taken from the monitored URL.

cheers
afx

[afx]

Well,

splunk show default-hostname
splunk show servername

both report the correct hostname....

And actually, I would think it makes more sense to set the host of the target URL than the querying host here.

thx
afx

[nickhills]

That sounds like the splunk server running the website monitor has an incomplete hostname.
Check in server.conf and inputs.conf on your server and make sure they are both set to what you expect.

The host(server)name in server.conf and the host in inputs.conf are automatically populated the first time splunk starts, but if you have cloned/restored or otherwise replaced the config files this can get out of sync.

You can either fix the names by hand in those files and restart the server, or use the cli commands
./splunk set servername yourForwarderName

./splunk set default-hostname yourForwarderName

https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Changedefaultvalues