Perform: only give host name instead of FQDN

keiichilam — Fri, 27 May 2011 08:03:51 GMT

I have a splunk universal forwarder , The Perform can only give me the short host name.
but at the same time WinEventLog:* can give me correct FQDN,

I want to have consistent host name across the environment. any one have some idea?
I have set up host=win-dns.domain.org in inputs.conf (both sysetm\lcoal and apps\msicreate\local)

========EVENT SEARCH SAMPLE============
05/27/2011 15:40:10.833
collection="Network Interface"
object="Network Interface"
counter="Bytes Received/sec"
instance="Intel[R] PRO_1000 MT Network Connection"
Value=2424.3003755975237

sourcetype=Perfmon:Network Interface 
source=Perfmon:Network Interface
host=**WIN-DNS1**

Re: Perform: only give host name instead of FQDN

Takajian — Wed, 08 Jun 2011 01:35:28 GMT

The reason WinEventLog:* can give you correct FQDN is Splunk extract ComputerName of WinEventLog as host name by default. So, you need to be aware of this in order to have consistent host name for windows eventlog and other sourcetype. Hope this help.

topic Re: Perform: only give host name instead of FQDN in Getting Data In

Perform: only give host name instead of FQDN

Re: Perform: only give host name instead of FQDN