https://community.splunk.com/t5/Deployment-Architecture/set-hostname/m-p/238938#M8960 <P>Hi at all,<BR /> I have to create an Heartbeat Alert that contains three fields:</P> <UL> <LI>TimeStamp,</LI> <LI>HostName</LI> <LI>Message My problem is HostName because I have a Search Head Cluster with three SH, so I cannot use a fixed value and I don't know how to set in a search the value of the present SH that is executing the search. Is there a way to do this?</LI> </UL> <P>Thank You.<BR /> Bye.<BR /> Giuseppe</P> Fri, 25 Nov 2016 13:24:36 GMT gcusello 2016-11-25T13:24:36Z https://community.splunk.com/t5/Deployment-Architecture/set-hostname/m-p/238938#M8960 <P>Hi at all,<BR /> I have to create an Heartbeat Alert that contains three fields:</P> <UL> <LI>TimeStamp,</LI> <LI>HostName</LI> <LI>Message My problem is HostName because I have a Search Head Cluster with three SH, so I cannot use a fixed value and I don't know how to set in a search the value of the present SH that is executing the search. Is there a way to do this?</LI> </UL> <P>Thank You.<BR /> Bye.<BR /> Giuseppe</P> Fri, 25 Nov 2016 13:24:36 GMT https://community.splunk.com/t5/Deployment-Architecture/set-hostname/m-p/238938#M8960 gcusello 2016-11-25T13:24:36Z https://community.splunk.com/t5/Deployment-Architecture/set-hostname/m-p/238939#M8961 <P>You can use <CODE>$server.serverName$</CODE> in the email alert settings: <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens#Server_tokens">http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/EmailNotificationTokens#Server_tokens</A></P> <P>In an actual search, you can use <CODE>| rest splunk_server=local /services/server/info</CODE> to grab the search head you're running on.</P> Fri, 25 Nov 2016 14:08:29 GMT https://community.splunk.com/t5/Deployment-Architecture/set-hostname/m-p/238939#M8961 martin_mueller 2016-11-25T14:08:29Z https://community.splunk.com/t5/Deployment-Architecture/set-hostname/m-p/238940#M8962 <P>Thank you, your rest command answers to my question.<BR /> Bye.<BR /> Giuseppe</P> Fri, 25 Nov 2016 14:15:09 GMT https://community.splunk.com/t5/Deployment-Architecture/set-hostname/m-p/238940#M8962 gcusello 2016-11-25T14:15:09Z