Yes, that's exactly what I have. I just did a "splunk clean eventdata -index em_metrics" and after a few seconds, I saw the entity with wrong name labeled Inactive and a new Entity with the correct server name as Active,
Thanks for your help with the sourcetype, that was the key.
... View more
Thanks, I have em_metrics as the index and have Metrics -> collectd_http in the HEC settings.
I also verified that Hostname is set to the RHEL7 name. The only mention of the HEC server is in the stanza which includes the HEC server, port, and token.
... View more
I have this issue also. I have both the App and Add-on installed on my Win 2016 server and yet the Linux server is showing in App for Infra with the Win2016 server name and HEC port number. The metrics do indicate it's a RHEL7 server, with the name of my Windows box.
Did you do anything after installing the Add-on? I've removed both App and Add-on, deleted the index, installed both the App and Add-on and I still get the name of the Windows server for my Linux box.
... View more