https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-indexing-two-hostnames-when-I-only-have-one-set-in/m-p/204825#M40430 <P>I am guessing /var/log/secure are linux secure -- did you happen to install the TA? My best guess is that there's a transforms/props file on the searchhead that is causing the host name to be re-written depending on the content of the message. Do you notice a pattern of which ones say mymachine versus the others?</P> Mon, 18 Apr 2016 16:55:14 GMT ryandg 2016-04-18T16:55:14Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-indexing-two-hostnames-when-I-only-have-one-set-in/m-p/204824#M40429 <P>I am monitoring two files:<BR /> <CODE>/var/log/secure</CODE> and<BR /> <CODE>/var/log/messages</CODE></P> <P>In the Data Summary Hosts tab, I have two hosts:<BR /> <CODE>mymachine.mycompany.internal</CODE><BR /> <CODE>mymachine</CODE></P> <P>inputs.conf</P> <PRE><CODE>[default] host = mymachine.mycompany.internal </CODE></PRE> Mon, 18 Apr 2016 08:15:53 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-indexing-two-hostnames-when-I-only-have-one-set-in/m-p/204824#M40429 sureshsala 2016-04-18T08:15:53Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-indexing-two-hostnames-when-I-only-have-one-set-in/m-p/204825#M40430 <P>I am guessing /var/log/secure are linux secure -- did you happen to install the TA? My best guess is that there's a transforms/props file on the searchhead that is causing the host name to be re-written depending on the content of the message. Do you notice a pattern of which ones say mymachine versus the others?</P> Mon, 18 Apr 2016 16:55:14 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-indexing-two-hostnames-when-I-only-have-one-set-in/m-p/204825#M40430 ryandg 2016-04-18T16:55:14Z