- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Universal Forwader Hostname issues
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Universal Forwader Hostname issues
I have a universal forwader insatlled on AWS cloud instance.As autoscaling is set,when it met certain conditions,this instance will terminate and new instance will be created.But the issue is that on the new instance inputs.conf showing the old hostname,is there any way for splunk to automatically detect the hostname.Please help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we are using splunk version 4.3.2.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Mario,
When i am doing it manually,hostname not changing.Stopped splunk and removed host entry in inputs.conf and removed guid in server.conf.Then started splunk still splunk not able to populate the hostaname.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is your /etc/hosts and /etc/hostname being updated?
are your able to try with 4.3.4?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OS in ubuntu12.04
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we are using splunk version 4.3.2.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it should...which version of splunk and OS are you running?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
no you will need to do something similar to this similar question : universal-forwarder-on-dhcp-address
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
