Getting Data In

Why is splunk indexing two hostnames from one server?

airforceboricua
New Member

Backstory:
I'm running several instances in which they terminate nightly. These instances are automatically re-created in the morning. I have data volumes that are mounted to each instance that contains all of the splunk data. The splunk service is started after the initial boot scripts are ran.

Problem:
AWS provides a hostname by default which is changed with my boot scripts (Usually its something to this effect: 'ip-10-0-0-2'). Once splunk is started logs are being indexed as either the default hostname or the hostname in which my script has changed it to. The logs that are being sent by the default hostname are typically system logs such as syslog and a few others.

Question:
How can I fix this so that all logs are being sent under one hostname preferably the hostname that I have changed it to in my boot scripts?

0 Karma

hortonew
Builder

In $SPLUNK_HOME/etc/system/local there are two files which contain the hostname that Splunk uses when it sends data. You should modify these before going forward.

server.conf

[general]
serverName = <>

inputs.conf

[default]
host = <>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...