I have a universal forwader insatlled on AWS cloud instance.As autoscaling is set,when it met certain conditions,this instance will terminate and new instance will be created.But the issue is that on the new instance inputs.conf showing the old hostname,is there any way for splunk to automatically detect the hostname.Please help.
we are using splunk version 4.3.2.
Hi Mario,
When i am doing it manually,hostname not changing.Stopped splunk and removed host entry in inputs.conf and removed guid in server.conf.Then started splunk still splunk not able to populate the hostaname.
is your /etc/hosts and /etc/hostname being updated?
are your able to try with 4.3.4?
OS in ubuntu12.04
we are using splunk version 4.3.2.
it should...which version of splunk and OS are you running?
no you will need to do something similar to this similar question : universal-forwarder-on-dhcp-address