topic Re: How to set hostname for the Splunk Windows Universal Forwarder in Getting Data In

How to set hostname for the Splunk Windows Universal Forwarder

OldManEd — Fri, 16 Oct 2015 20:52:13 GMT

When I installed the Splunk Universal Forwarder for Windows, the inputs.conf file has the stanza;

[default]
host = <actual host name>

I want to make the Splunk Forwarder directories on this server part of an image to load onto other servers. So what do I change this stanza to, if anything, to get it to use the name of the server that it's being loaded on?

Re: How to set hostname for the Splunk Windows Universal Forwarder

OldManEd — Fri, 16 Oct 2015 20:55:47 GMT

I just noticed that in the same directory, in the server.conf file, I have the following stanza;

[general]
pass4SymmKey = <Pass key number>
serverName = <actual host name>

I'm going to have to change that also. But to what?

Re: How to set hostname for the Splunk Windows Universal Forwarder

woodcock — Fri, 16 Oct 2015 21:56:11 GMT

Just delete the host= line from the file in your master image and splunk will automatically figure it out when you deploy the file and (re)start splunk.

Re: How to set hostname for the Splunk Windows Universal Forwarder

OldManEd — Fri, 16 Oct 2015 22:11:00 GMT

This seemed to work. I commented out the "host =" and "serverName =" lines in the "inputs.conf" and "server.conf" files respectively and the Forwarder serrvice did start this time and it was named correctly in the Deployment server when it "Phoned Home". But I noticed that the "inputs.conf" and "server.conf" files were not updated. I assume the Splunk Forwarder is looking someplace else for the default server name.

Anyway, thanks.

Re: How to set hostname for the Splunk Windows Universal Forwarder

mtranchita — Fri, 16 Oct 2015 23:40:37 GMT

In the spec, found at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
it shows that the value in system/default/inputs.conf is $decideOnStartup
On first run this will write to system/local. You can prestage that value in the system/local (or override system/default with an app) so that the UF polls the OS every time it starts.