topic Re: Universal Forwader Hostname issues in Getting Data In

Universal Forwader Hostname issues

sreejithpoothu — Mon, 17 Sep 2012 15:28:04 GMT

I have a universal forwader insatlled on AWS cloud instance.As autoscaling is set,when it met certain conditions,this instance will terminate and new instance will be created.But the issue is that on the new instance inputs.conf showing the old hostname,is there any way for splunk to automatically detect the hostname.Please help.

Re: Universal Forwader Hostname issues

MarioM — Mon, 17 Sep 2012 18:55:57 GMT

no you will need to do something similar to this similar question : universal-forwarder-on-dhcp-address

Re: Universal Forwader Hostname issues

sreejithpoothu — Tue, 18 Sep 2012 01:19:58 GMT

Hi Mario,

When i am doing it manually,hostname not changing.Stopped splunk and removed host entry in inputs.conf and removed guid in server.conf.Then started splunk still splunk not able to populate the hostaname.

Re: Universal Forwader Hostname issues

MarioM — Tue, 18 Sep 2012 05:17:50 GMT

it should...which version of splunk and OS are you running?

Re: Universal Forwader Hostname issues

sreejithpoothu — Tue, 18 Sep 2012 07:03:16 GMT

we are using splunk version 4.3.2.

Re: Universal Forwader Hostname issues

sreejithpoothu — Tue, 18 Sep 2012 07:03:32 GMT

we are using splunk version 4.3.2.

Re: Universal Forwader Hostname issues

sreejithpoothu — Tue, 18 Sep 2012 07:04:26 GMT

OS in ubuntu12.04

Re: Universal Forwader Hostname issues

MarioM — Tue, 18 Sep 2012 08:27:36 GMT

is your /etc/hosts and /etc/hostname being updated?

are your able to try with 4.3.4?