Deployment Architecture

Linux Servers not showing in Hosts lists

hyoung
New Member

I have added a few Ubuntu Linux server. They are forwarding log data no problem, and I can search it. Problem is that they do not show up as "Hosts" so I can modify queries based on that. How do I tag them as Hosts?

Tags (1)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You shouldn't have to tag your data as Hosts. It is just based on the "host" field that the data is indexed with. When you search for your data, what "host" is set for it?

If you do a search like:

| metadata type=hosts | search host=<host of your data>

What is returned? This is essentially the search used to populate the dashboard.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

You shouldn't have to tag your data as Hosts. It is just based on the "host" field that the data is indexed with. When you search for your data, what "host" is set for it?

If you do a search like:

| metadata type=hosts | search host=<host of your data>

What is returned? This is essentially the search used to populate the dashboard.

hyoung
New Member

It just took a while for the dashboard to populate I guess. I think I was referring to the *NIX app at that time. It still does not show the "Hosts". I have opened another post that is more specific to the problem.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...