Hey everyone. We are working to get a deployment server up and running. However our original manual configurations include in the inputs.conf file a host=
So can that be manually configured in another file at install time of the forwarder in another configuration file? We've looked at modifying server.conf's serverName= field, but that doesn't appear to make any difference.
When configuring the splunk deployment client, you can set
clientName =
in deploymentclient.conf as the hostname of the particular client to be sent to the deployment server. This would allow you to create stanzas in serverclass.conf to web-1.domain.com, even though the actual hostname on this particular server might be web.domain.com
Thanks,
--adam
So, in the configuration distributed by the deployment server, are you specifying host=
in inputs.conf? I think first thing is to remove that.
What will work is specifying host=<fqdn>
in etc/system/local/inputs.conf
.
This is also set by Splunk when installing. However the name used is whatever is returned by the hostname
command. So before installing splunk, you need your /etc/hosts
set up to specify the FQDN as hostname, or use DNS. If you already installed splunk, or if you can't change the hots's configs, edit etc/system/local/inputs.conf
manually.