topic FQDN for windows servers in deployment server GUI in Splunk Enterprise

FQDN for windows servers in deployment server GUI

AJ2024 — Thu, 02 May 2024 16:47:42 GMT

I am trying to change the host name from short name to FQDN in the deployment server gui for windows servers.I have the input.conf and server.conf already set as $decideOnStartup and fullyqualifiedname respectively in the local app folder.The hostname doesn't change in the GUI .The search logs shows FQDN for windows servers after setting up the input and server conf as above. But the hostname in GUI remains the same as shortname. How do I change it?

Re: FQDN for windows servers in deployment server GUI

deepakc — Thu, 02 May 2024 17:14:29 GMT

I would try to reboot the deployment server – It could be cache issue.

Re: FQDN for windows servers in deployment server GUI

AJ2024 — Thu, 02 May 2024 18:31:32 GMT

I had restarted the deployment server already. But the hostname remains the same as short name in the GUI.

Re: FQDN for windows servers in deployment server GUI

deepakc — Thu, 02 May 2024 19:03:36 GMT

I dont have Windows server to test this out, so dont know if this works, but this its used for customizing the client behaviour, the file is deploymentclient.conf and normally you deploy this under a dedicated app and install onto the target server.

Example
/my_app/local/deploymentclient.conf

$SPLUNK_HOME/etc/system/local/deploymentclient.conf

Config
[deployment-client]
clientName = $FQDN

(So you may be able to use a Powershell script after install of the UF and try inject that config into clientName section into the file, test on one server manually first and see, if it works)

To get the FQDN via powershell

Poweshell to get FQDN Name
$FQDN = "$env:COMPUTERNAME.$env:USERDNSDOMAIN"
Write-Output $FQDN

Re: FQDN for windows servers in deployment server GUI

AJ2024 — Fri, 03 May 2024 17:39:39 GMT

I tried below script in my windows test vm and restarted the splunk. Hostname still shows as the short name in Splunk GUI. The search logs shows the fqdn though .

On the deployment server , in the forwarder management client view, how is the hostname column populated? Or where is the hostname column populated from? I need the hostname in the forwarder management client view to show the fqdn of the windows endpoints.

Re: FQDN for windows servers in deployment server GUI

deepakc — Sat, 04 May 2024 06:48:20 GMT

I'm starting to think if the Windows HOST has the NetBIOS name then this is what you end up with in Deployment server HOST column, unless during install it doesn’t have the FQDN name (+DNS).

I know your searches are coming up with FQDN, so I'm stumped as to the hosts column part not showing FQDN!

This setting will change from the GUID setting to the FQDN Names Client Name, in Deployment Server And allow Filter on FQDN

deploymentclient.conf

[deployment-client]

clientName = FQDN

This setting will change the instance name in Deployment Server

server.conf

serverName = FQDN