topic Re: Why do I see the same host twice? in Deployment Architecture

Why do I see the same host twice?

dmitchell92 — Mon, 16 Jul 2018 16:18:31 GMT

Hello Splunkers,

When I search to see that host are in the appropriate index "index=indexname | stats count by host" I will see the same host listed twice. Once with the hostname of the forwarder and another with the FQDN of the forwarder. I believe that that culprit of this issue is because when engineers install forwards on host, they run "./splunk set forward-server ip_address:9997" then me as the splunk admin will add the sendtoindexer deployment app to the server class. Am I on the right track here or way off basis?

Thanks Splunkers!

Re: Why do I see the same host twice?

pradeepkumarg — Mon, 16 Jul 2018 17:10:28 GMT

Check if this helps

https://answers.splunk.com/answers/642834/why-are-there-multiple-host-entries-for-every-splu.html#answer-642944

Re: Why do I see the same host twice?

dmitchell92 — Mon, 16 Jul 2018 17:33:04 GMT

This helps makes better sense of the culprit. What is best practice so I can eliminate the multiple host reporting? Across our infrastructure we have a unique naming convention so I would prefer everything to not have the FQDN in the host field.