Getting Data In

Will Splunk update the host field in indexed events if a universal forwarder's system name is changed?

john_dagostino
Path Finder

So after months of battling an issue with our indexers dropping connections, we determined that there was a problem with the indexers performing reverse DNS lookups for the connecting servers. To mitigate, we added 'connection_host = none' to the inputs.conf resolving the issue.

If I understand how the host field in the indexed events is populated correctly, with 'connection_host = none' set on the indexers we will now rely on the 'host = ' field in inputs.conf on the UF's. I know this value is automatically populated with the server name when Splunk is first installed, however what happens if a server is renamed? Will it modify the inputs.conf to replace the 'host =' field with the new server name?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

It won't. You can change the default host fields name using method described here:

https://answers.splunk.com/answers/154999/how-can-i-change-the-default-hostname-in-splunk.html

john_dagostino
Path Finder

With several thousand forwarders it seems that the risk of having an incorrectly named host would be high. Is there a better way to manage this other than reverse DNS lookup?

Any idea what does the following setting in inputs.conf does?

host =
* If set to '$decideOnStartup', will be interpreted as hostname of executing
machine; this will occur on each splunkd startup.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...