https://community.splunk.com/t5/Getting-Data-In/Post-Server-Rename-weirdness/m-p/67965#M13741 <P>We performed renames on several servers and am seeing them all show with a weird issue. It seems that there are still lingering traces of the old server name. I have searched adn ready, however, no luck with my specific situation. Thanks!</P> <P>Error Example:</P> <P>03/24/11 11:12:45 AM<BR /> LogName=Application<BR /> SourceName=application.dll<BR /> EventCode=5146<BR /> EventType=1<BR /> Type=Error<BR /> ComputerName=<STRONG>CHEXNEWNAME001</STRONG><BR /> Category=0<BR /> CategoryString=none<BR /> RecordNumber=2215617<BR /> Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.<BR /> <BR /> Got the following information from this event: <BR /> <BR /> c:\appfolder\server\systemslip.exe[C:\FolderName\application.dll] Computer: <STRONG>CHEXNEWNAME001</STRONG>; Thread: 0x1e90; DateTime: 3/24/2011 11:12:45; Product ID: -1</P> <P>FGetVersionFile failed to get the publication version from the publisher share = \HOST\APP\VERSION\x86UNI\V30\SegEngineCarMarkupOffsetSpecific\CV1. Publication name = SegEngineCarMarkupOffsetSpecific<BR /><BR /> Collapse back to 10 lines • host=<STRONG>CHE-TVOLDNAME122</STRONG> Options|<BR /> • sourcetype=WinEventLog:Application Options|<BR /> • source=WinEventLog:Application Options</P> Sat, 26 Mar 2011 01:54:17 GMT dchristilaw 2011-03-26T01:54:17Z https://community.splunk.com/t5/Getting-Data-In/Post-Server-Rename-weirdness/m-p/67965#M13741 <P>We performed renames on several servers and am seeing them all show with a weird issue. It seems that there are still lingering traces of the old server name. I have searched adn ready, however, no luck with my specific situation. Thanks!</P> <P>Error Example:</P> <P>03/24/11 11:12:45 AM<BR /> LogName=Application<BR /> SourceName=application.dll<BR /> EventCode=5146<BR /> EventType=1<BR /> Type=Error<BR /> ComputerName=<STRONG>CHEXNEWNAME001</STRONG><BR /> Category=0<BR /> CategoryString=none<BR /> RecordNumber=2215617<BR /> Message=Splunk could not get the description for this event. Either the component that raises this event is not installed on your local computer or the installation is corrupt.<BR /> <BR /> Got the following information from this event: <BR /> <BR /> c:\appfolder\server\systemslip.exe[C:\FolderName\application.dll] Computer: <STRONG>CHEXNEWNAME001</STRONG>; Thread: 0x1e90; DateTime: 3/24/2011 11:12:45; Product ID: -1</P> <P>FGetVersionFile failed to get the publication version from the publisher share = \HOST\APP\VERSION\x86UNI\V30\SegEngineCarMarkupOffsetSpecific\CV1. Publication name = SegEngineCarMarkupOffsetSpecific<BR /><BR /> Collapse back to 10 lines • host=<STRONG>CHE-TVOLDNAME122</STRONG> Options|<BR /> • sourcetype=WinEventLog:Application Options|<BR /> • source=WinEventLog:Application Options</P> Sat, 26 Mar 2011 01:54:17 GMT https://community.splunk.com/t5/Getting-Data-In/Post-Server-Rename-weirdness/m-p/67965#M13741 dchristilaw 2011-03-26T01:54:17Z https://community.splunk.com/t5/Getting-Data-In/Post-Server-Rename-weirdness/m-p/67966#M13742 <P>Check the files in <CODE>$SPLUNK_HOME\etc\system\local</CODE> on the forwarder -- the old hostname is probably still present in one of the config files. Check <CODE>server.conf</CODE> and <CODE>inputs.conf</CODE> in particular.</P> Sat, 26 Mar 2011 08:44:21 GMT https://community.splunk.com/t5/Getting-Data-In/Post-Server-Rename-weirdness/m-p/67966#M13742 southeringtonp 2011-03-26T08:44:21Z