topic SplunkUniversalForwarder instanceName = none in Splunk Enterprise

SplunkUniversalForwarder instanceName = none

cjpote — Fri, 04 Aug 2017 17:02:03 GMT

Some cloned Red Hat Enterprise Linux 7 systems show blank "Instance Name" values on my deployment server's Forwarder Management tab, and when executing ./splunk list deploy-clients, the forwarders instanceName value is shown as "none".
Where is the instanceName value set?

Re: SplunkUniversalForwarder instanceName = none

adonio — Fri, 04 Aug 2017 17:19:59 GMT

check /splunkforwarder/etc/system/local/inputs.conf and /splunkforwarder/etc.system/local/server.conf
hope it helps

Re: SplunkUniversalForwarder instanceName = none

cjpote — Tue, 29 Sep 2020 15:12:56 GMT

Sorry, I should have mentioned that I already verified the "serverName = " value in $SPLUNK_HOME/etc/system/local/server.conf, and "host = " in $SPLUNK_HOME/etc/system/local/inputs.conf. They are both set to the same value returned by the "hostname" command on the system.

I also verified that "$SPLUNK_HOME/bin/splunk cmd btool [server|inputs] list --debug" shows the correct serverName and host values; but neither one of those shows an "instance(Name) = " value.

Re: SplunkUniversalForwarder instanceName = none

jhidalgo_splunk — Tue, 24 Apr 2018 15:23:04 GMT

Look at https://answers.splunk.com/answers/171928/how-can-i-control-the-clients-host-name-that-appea.html or https://answers.splunk.com/answers/106684/blank-forwarder-management-page-on-splunk-6.html