topic Re: How to change the host name on remote instance (client)? in Splunk Dev

How to change the host name on remote instance (client)?

Deepali529 — Thu, 29 Dec 2016 05:54:56 GMT

I have Splunk instance (master) from where I need to migrate indexed data to another instance (client). I have archive the indexed data on instance (master) by setting up NFS mount point and copied archived data in thawed bucket on instance (client). Now, I need to retrieve it on my new host (Client).
As, host name of both the machines are different when I retrieved it, it displays older host. name (master's host name).

Where to change host value so that it will show the client instance host name ?
Splunk version using = 6.5.0

Re: How to change the host name on remote instance (client)?

lguinn2 — Sun, 01 Jan 2017 17:59:24 GMT

When data is indexed in Splunk, the host, source and sourcetype of the data are stored along with the raw events. Once indexed, these values cannot be changed. If what you want to see is the name of the machine that is storing the data, use splunk_server instead of host

Re: How to change the host name on remote instance (client)?

Deepali529 — Mon, 02 Jan 2017 04:48:24 GMT

in inputs.conf I need to mention splunk_server?

Re: How to change the host name on remote instance (client)?

Deepali529 — Mon, 02 Jan 2017 05:05:14 GMT

thanks... 🙂 its showing the instance name(client server)

Re: How to change the host name on remote instance (client)?

lguinn2 — Mon, 02 Jan 2017 09:50:17 GMT

Not in inputs.conf, use splunk_server in your search.

You should set the host name to the correct host in inputs.conf - but this will affect only newly indexed data. Data that has already been indexed will not change.