topic Help with setting the hostname path on ~200 servers? in Getting Data In

Help with setting the hostname path on ~200 servers?

FIS1 — Tue, 29 Sep 2020 15:34:59 GMT

We are pushing out forwarders to over 200 servers this month. I intend to connect the forwarders to a deployment server and then push out the server.conf file using the below setup.

[general]
serverName = $HOSTNAME

Since there are so many servers I do not want to manually set the hostname for each server. This seems to work but when I got to edit the inputs.conf file we have to monitor a server.log file that has the hostname before it.

[monitor:///testarea/host1_server.log]

I have tried setting "host1" to "$HOSTNAME" and "hostname". All which return the actual we are trying to monitor

When doing a ls -ltr on /testarea/$HOSTNAME_server.log it returns /testarea/host1_server.log.

Is Splunk able to do this?

Re: Help with setting the hostname path on ~200 servers?

jkat54 — Wed, 30 Aug 2017 18:52:35 GMT

Why wouldnt you just use a wildcard in your monitor stanza?

[monitor:///testarea/*_server.log]

Re: Help with setting the hostname path on ~200 servers?

ddrillic — Wed, 30 Aug 2017 18:57:23 GMT

You can run during the install process something like the following command -

/opt/splunk/splunkforwarder/bin/splunk set default-hostname <host>

Re: Help with setting the hostname path on ~200 servers?

FIS1 — Wed, 30 Aug 2017 20:28:59 GMT

Thanks jkat54 ... smh not sure why i was thinking i needed to get hostname for that path as that is the only file that ends with _server.log.