topic Re: Need to hard code host reported by Universal Forwarder in Getting Data In

Need to hard code host reported by Universal Forwarder

kollerj — Wed, 13 Jan 2016 20:42:40 GMT

Hello,

We are currently in the process of moving some of our hosts from Solaris to Windows. These hosts are part of Veritas clusters.

Currently, the Solaris hosts report the Veritas cluster name via the Universal Forwarder. We'd like to mimic this behavior within the Windows environment.

I've attempted multiple things, including updating the host entry within the inputs.conf file, to no avail. Splunk continues to report the physical host name of the server that the processes are running on.

Any idea how to hard code the host name that is reported to our aggregation server via the Universal Forwarder?

Thanks!

Re: Need to hard code host reported by Universal Forwarder

somesoni2 — Wed, 13 Jan 2016 21:49:55 GMT

The host change in the inputs.conf will only change the host metadata for the events being monitored. You can change host name in the server.conf as well to change host property for internal logs.

Re: Need to hard code host reported by Universal Forwarder

vasanthmss — Wed, 13 Jan 2016 21:54:24 GMT

Hi Kollerj,

Try to update like this,

$SPLUNK_HOME/etc/system/local/server.conf
[general]
serverName = <host_name>

$SPLUNK_HOME/etc/system/local/inputs.conf
[default]
host = <host_name>

Check your other inputs.conf from other apps have host entry or not? I guess the apps you are on-boarding or monitoring inputs.conf has older entry.

Or you can use the below CLI commands,

./splunk set servername <host>
./splunk set default-hostname <host>

For windows you need to update server.conf's general stanza with additional option

[general]
hostnameOption = <ASCII string>
* The option used to specify the detail in the server name used to identify
  this Splunk instance.
* Can be one of "fullyqualifiedname" , "clustername", "shortname"
* Is applicable to Windows only
* Shall not be an empty string

Ref: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf

Thanks,
V

Re: Need to hard code host reported by Universal Forwarder

vasanthmss — Thu, 14 Jan 2016 17:34:02 GMT

Restart the server after configure the host name to see the changes. Accept the answer if it solves your issue.

Re: Need to hard code host reported by Universal Forwarder

kollerj — Tue, 29 Sep 2020 08:25:55 GMT

Hi vasanthmss,

Thanks for the response.

Unfortunately, this did not resolve the issue. I see that both the inputs.conf and server.conf were updated to mlp-da02 by following your CLI commands -- I restarted both the forwarder as well as our central server, to no avail -- it is still reporting as xmlspap2x.

server.conf:
[sslConfig]
sslKeysfilePassword = X

[general]
pass4SymmKey = X
serverName = mlp-da02

[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder

[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free

inputs.conf:
[default]
host = mlp-da02

splunkd.log:
01-14-2016 10:43:59.734 -0800 INFO ServerConfig - My server name is "mlp-da02".
01-14-2016 10:43:59.734 -0800 INFO ServerConfig - Found no site defined in server.conf
01-14-2016 10:43:59.734 -0800 INFO ServerConfig - Found no hostname options in server.conf. Will attempt to use default for now.
01-14-2016 10:43:59.734 -0800 INFO ServerConfig - Host name option is "".
01-14-2016 10:43:59.734 -0800 INFO ServerConfig - My hostname is "XMLSPAP2X".
01-14-2016 10:43:59.749 -0800 INFO ServerConfig - Setting HTTP server compression state=on
01-14-2016 10:43:59.749 -0800 INFO ServerConfig - Setting HTTP client compression state=0 (false)
01-14-2016 10:43:59.749 -0800 INFO ServerConfig - Default output queue for file-based input: parsingQueue.

Any other thoughts?

Thanks,

Jason

Re: Need to hard code host reported by Universal Forwarder

vasanthmss — Fri, 15 Jan 2016 03:07:25 GMT

Are you positive you have updated in system local? Restart the service and check once...
Use btool command to check your inputs and server conf

Re: Need to hard code host reported by Universal Forwarder

vasanthmss — Fri, 15 Jan 2016 03:17:11 GMT

I got you..... in windows you need to add another parameter for host name in server.conf

[general]
hostnameOption = <ASCII string>
* The option used to specify the detail in the server name used to identify
  this Splunk instance.
* Can be one of "fullyqualifiedname" , "clustername", "shortname"
* Is applicable to Windows only
* Shall not be an empty string

Updating previous answer with this option

Re: Need to hard code host reported by Universal Forwarder

vasanthmss — Fri, 15 Jan 2016 20:12:40 GMT

Is that helped?

Re: Need to hard code host reported by Universal Forwarder

kollerj — Fri, 15 Jan 2016 21:08:18 GMT

Hi Vasanthmss,

What do you think this option needs to be set to? I don't have any environment variables that match "mlp-da02" so I'm not sure which one I'd use. Do you know where it pulls each name from?

Thanks,

Jason

Re: Need to hard code host reported by Universal Forwarder

vasanthmss — Fri, 15 Jan 2016 22:45:34 GMT

Honestly I never tried it. You can try one by one....

Re: Need to hard code host reported by Universal Forwarder

kollerj — Mon, 18 Jan 2016 20:42:07 GMT

Unfortunately, none of the options got me what I was looking for.

01-18-2016 12:37:52.014 -0800 INFO ServerConfig - Host name option is "shortname".
01-18-2016 12:37:52.014 -0800 INFO ServerConfig - My hostname is "xmlspap2x".

01-18-2016 12:32:28.343 -0800 INFO ServerConfig - Host name option is "fullyqualifiedname".
01-18-2016 12:32:28.343 -0800 INFO ServerConfig - My hostname is "xmlspap2x.lsas.ca.kp.org".

01-18-2016 12:35:06.332 -0800 INFO ServerConfig - Host name option is "clustername".
01-18-2016 12:35:06.332 -0800 INFO ServerConfig - My hostname is "xmlspap2x".

An other ideas?

Thanks,

Jason

Re: Need to hard code host reported by Universal Forwarder

sgarvin55 — Thu, 18 Feb 2016 22:45:35 GMT

The value that changes the "server name" is under the server.conf file. Changing the name should be done in two places, inputs.conf and server.conf. The "host name" value is taken from the server, when the server was first created or changed at the OS level. There isn't a splunk config file that will change the "host name" value.
Second, the data coming from the UF, will have the "server name" when it reaches the indexer and can be searched by host="mlp-da02" as in the example above.