topic Re: DNS lookup failed for "$decideOnStartup": Host not found (authoritative) in Getting Data In

DNS lookup failed for "$decideOnStartup": Host not found (authoritative)

beginne_Splunk — Tue, 18 Apr 2023 05:06:47 GMT

When 'tail -f /opt/streamfwd/var/log/streamfwd.log' is executed

Why do I get the following message?

WARN [140610710128384] (HTTPRequestSender.cpp:1485) stream.SplunkSenderHTTPEventCollector - (#0) DNS lookup failed for "$decideOnStartup": Host not found (authoritative)
WARN [140610710128384] (HTTPRequestSender.cpp:1470) stream.SplunkSenderHTTPEventCollector - (#0) Recovery attempt failed

Re: DNS lookup failed for "$decideOnStartup": Host not found (authoritative)

wagenstallerm — Fri, 27 Oct 2023 16:43:19 GMT

same problem here

Re: DNS lookup failed for "$decideOnStartup": Host not found (authoritative)

_JP — Fri, 27 Oct 2023 17:15:23 GMT

There's several older posts that seem to be related to a default setting not being correct in their case in an etc/system/local/inputs.conf. I would check through your Splunk configs to see if there's a server name not set correctly, or if an override is in place that is causing it to use a non-existent hardcoded value instead of relying on what the OS thinks the server name is (i.e. look through our .conf files):

Solved: Inputs.conf $decideonstartup - Splunk Community

Why is host=$decideOnStartup for Splunk Stream, bu... - Splunk Community

How to Configure host = $decideOnStartup correctl... - Splunk Community

Solved: $decideOnStartup Remote Perfmon - Splunk Community

Re: DNS lookup failed for "$decideOnStartup": Host not found (authoritative)

PickleRick — Sat, 28 Oct 2023 08:09:43 GMT

The error message says clearly "DNS lookup failed" which means that system resolver cannot determine reliably a hostname for the local IP. You can run some packet capture tool to verify what lookup exactly is performed at the start of the UF.

Re: DNS lookup failed for "$decideOnStartup": Host not found (authoritative)

Jcath — Mon, 13 Oct 2025 10:13:38 GMT

i have solved this problem. It is because i hadn't change my hostname on httpinput. The way to do this is:

- Go to "/etc/apps/splunk_httpinput/local/inputs.conf" on your splunk enterprise

- add this code line to change your hostname:

[default]

host = <your-IP>

- restart splunk

Hope this helps