https://community.splunk.com/t5/Getting-Data-In/Why-am-I-seeing-host-multiple-times-in-search/m-p/304001#M57368 <P>Hello Splunkers,</P> <P>I'm trying to validate that engineers have successfully deployed forwarders on all required systems. All Sites have their own index. So I'm running the following search to check:</P> <PRE><CODE>index=siteA | stats count by host </CODE></PRE> <P>This returns the hosts, but for my Linux machines I see "machineA" followed by "machineA.siteA.local." </P> <P>Does anyone have any insight as to what might be the problem? Per my instructions, the engineers have uninstalled old forwarders before installing a new version for our Splunk rebuild.</P> <P>Thanks so much!</P> Wed, 04 Apr 2018 19:45:30 GMT dmitchell_ingre 2018-04-04T19:45:30Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-seeing-host-multiple-times-in-search/m-p/304001#M57368 <P>Hello Splunkers,</P> <P>I'm trying to validate that engineers have successfully deployed forwarders on all required systems. All Sites have their own index. So I'm running the following search to check:</P> <PRE><CODE>index=siteA | stats count by host </CODE></PRE> <P>This returns the hosts, but for my Linux machines I see "machineA" followed by "machineA.siteA.local." </P> <P>Does anyone have any insight as to what might be the problem? Per my instructions, the engineers have uninstalled old forwarders before installing a new version for our Splunk rebuild.</P> <P>Thanks so much!</P> Wed, 04 Apr 2018 19:45:30 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-seeing-host-multiple-times-in-search/m-p/304001#M57368 dmitchell_ingre 2018-04-04T19:45:30Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-seeing-host-multiple-times-in-search/m-p/304002#M57369 <P>Some inputs can return the shortname and some return the FQDN. Check to ensure your forwarder's inputs.conf hostname under [default] matches the name in server.conf and that any other inputs do not specify a host explicitly.</P> Thu, 05 Apr 2018 00:24:14 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-seeing-host-multiple-times-in-search/m-p/304002#M57369 davpx 2018-04-05T00:24:14Z