topic Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure? in Getting Data In

Splunk Forwarder to automatically use FQDN as hostname, how to configure?

xisteam — Thu, 09 Dec 2021 21:35:37 GMT

Hi!

How can I configure Splunk Universal Forwarder in Linux to use FQDN - basically the result of hostname -f - as hostname automatically, i.e. without "hard-wiring" the FQDN in any of Splunk's configuration files? If no simple configuration to do this, probably there is a way to do it with a script that triggered every time I start Splunk Forwarder?

I have been using host = $decideOnStartup in inputs.conf, which pick up the hostname of the machine. However for many distro hostname is just the first part of FQDN.

Thank you!

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

tshah-splunk — Fri, 31 Dec 2021 17:19:29 GMT

Hi..!!

If you want to use FQDN for the host, you can continue using host = $decideOnStartup in inputs.conf.

Along with this, you'll need to set below config in server.conf

 hostnameOption=fullyqualifiedname

More informations related to hostname can be found in server.conf

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

mattymo — Fri, 31 Dec 2021 18:38:26 GMT

Looks like `hostnameOption` is Windows only, fyi..

hostnameOption = [ fullyqualifiedname | clustername | shortname ] * The type of information to use to determine how splunkd sets the 'host' value for a Windows Splunk platform instance when you specify an input stanza with 'host = $decideOnStartup'. * Applies only to Windows hosts, and only for input stanzas that use the "host = $decideOnStartup" setting and value. * Valid values are "fullyqualifiedname", "clustername", and "shortname". * The value returned for the 'host' field depends on Windows DNS, NETBIOS, and what the name of the host is. * 'fullyqualifiedname' uses Windows DNS to return the fully qualified host name as the value. * 'clustername' also uses Windows DNS, but sets the value to the domain and machine name. * 'shortname' returns the NETBIOS name of the machine. * Cannot be an empty string. * Default: shortname

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

SanjayReddy — Sun, 02 Jan 2022 07:55:32 GMT

Can we also try with

following option in inputs.conf

[default]
host=<hostnameinfqdn>

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

xisteam — Wed, 23 Mar 2022 16:07:23 GMT

Thanks, but unfortunately this does not work, Splunk still only take the short hostname - not FQDN - as hostname.

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

xisteam — Wed, 23 Mar 2022 16:09:20 GMT

Confirming @mattymo response, unfortunately this does not work, Splunk still only take the short hostname - not FQDN - as hostname.

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

SanjayReddy — Wed, 23 Mar 2022 16:29:49 GMT

Hi @xisteam

just for re verification, I have performed same steps in my personal system mentioned earlier reply, I am able to change the host value

under etc/system/local I added follwing

[default]
host=dummy

[monitor://‪C:\Program Files\Splunk\var\log\splunk\splunkd.log]
disabled = false
sourcetype = test
index = main

restarted the splunk

now I am able to updated host name

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

xisteam — Thu, 24 Mar 2022 15:49:08 GMT

Sorry, I think you misunderstood my question. I already knew that specifying a hostname explicitly will work. However, I am interested in having the hostname automatically set - either on Splunk startup or machine startup or more often - to the FQDN of the machine at the time. Therefore if I ever change the hostname of the machine - which we do quite often here - the hostname Splunk uses will automatically changed as well. And Splunk actually have solution for MS Windows (use hostnameinfqdn in server.conf as mentioned above), but that does not work in Linux.

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

xisteam — Thu, 24 Mar 2022 15:53:17 GMT

I meant using

hostnameOption=fullyqualifiedname

But it won't work in Linux.

Re: Splunk Forwarder to automatically use FQDN as hostname, how to configure?

SanjayReddy — Sun, 27 Mar 2022 07:34:14 GMT

Hi @xisteam

try using command

$SPLUNK_HOME$/bin

./splunk set servername <servername>

it will update server name in server.conf

[general]
serverName = Server1

| rest /services/authentication/users splunk_server=local
| dedup splunk_server
| table splunk_server

I hope you are expcting this ?