Is there anyway I could verify if there is any variable which could be used to extract hostname for inputs.conf? instead of explicitly mentioning hostname, I need to push the input.conf file to a set of systems...
hostname is defined in the $SPLUNKHOME/etc/system/local/inputs.conf. If you want to push out a standard inputs.conf to multiple splunk instances you have a few options:
Take a look at the configuration file reference in the documentation, this should make a lot more sense then. http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles
hostname is defined in the $SPLUNKHOME/etc/system/local/inputs.conf. If you want to push out a standard inputs.conf to multiple splunk instances you have a few options:
Take a look at the configuration file reference in the documentation, this should make a lot more sense then. http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles
thank you so much, i think this is what i was looking for, i am going to be working to use this feature for scaling the updated conf files...
Well. In a standard install, the first time Splunk is run, it executes hostname
and puts the result into $SPLUNK_HOME/etc/system/local/inputs.conf
as the default hostname. That is what will be used for all inputs from this local machine unless otherwise specified or overridden. If that doesn't work for you then, at least as of 4.1.2, you'll have to figure out a way to regenerate the value in that file separately from any Splunk functionality.
By default it is taking the IP of that system, although the fqdn is ssomething like : abcd.xyz.com, is there anyway I should be overwriting the hostname, like some default variable..