topic Getting FQDN name for multiple sources types as creating duplicate devices name? in Splunk Enterprise

Getting FQDN name for multiple sources types as creating duplicate devices name?

sekhar463 — Thu, 22 Sep 2022 15:08:55 GMT

Hai ,

we are getting data with host name as FQDN name for few linux hosts.

how to get hostname so that all events should come with hostname only, let us know where can i update the config.

Thanks

Re: Getting FQDN name for multiple sources types as creating duplicate devices name?

Azeemering — Mon, 26 Sep 2022 09:36:34 GMT

Please read this:

About hosts - Splunk Documentation

Re: Getting FQDN name for multiple sources types as creating duplicate devices name?

isoutamo — Mon, 26 Sep 2022 09:44:27 GMT

UF (and splunk in generally) use host name of node. Some times this is a FQDN sometime only host part. It depends how it has set up on OS level. If you are not happy with it you can change it on UF's inputs.conf file as setting it in default stanza. See details here https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/SetadefaulthostforaSplunkserver

If you have several domain where you are collecting events it's usually good habit to have fqdn instead of host part only. You can always drop host part on queries if you don't like those and those are not needed (see e.g. rex mode=sed). Of course FQDN use little bit more license, but still...

r. Ismo