topic Re: Why are there multiple host entries for every Splunk forwarder? in Getting Data In

Why are there multiple host entries for every Splunk forwarder?

meoo — Thu, 19 Apr 2018 05:48:08 GMT

We are installing splunk universal forwarder in all of our servers. It seems to be working fine, however there are multiple entries of each universal forwarder (fqdn and short name)

For example:

test.example.com (entry 1)
test (entry2)

I have verified that in the server.conf, the serverName entry is present.

[general]
serverName = test.example.com
pass4SymmKey = TEST

Can you share on what would be the right way to fix this issue ?

Re: Why are there multiple host entries for every Splunk forwarder?

somesoni2 — Thu, 19 Apr 2018 15:16:13 GMT

Check the inputs.conf as well for host attribute.

Re: Why are there multiple host entries for every Splunk forwarder?

pradeepkumarg — Thu, 19 Apr 2018 19:34:59 GMT

I've seen this usually with syslog (/var/log/syslog)

Syslog is a pre trained sourcetype and extracts the host from within the log itself and if the log has the hostname without FQDN, you see that.

Check the sourcetypes for each of those host entry |tstats count WHERE host=test* by host,sourcetype | stats values(sourcetype) by host

You will see your problematic sourcetype that is causing the host value without FQDN.

Re: Why are there multiple host entries for every Splunk forwarder?

woodcock — Sun, 22 Apr 2018 21:41:16 GMT

Read this carefully, including the clone-prep-clear-config command:
http://docs.splunk.com/Documentation/Forwarder/7.0.3/Forwarder/Makeauniversalforwarderpartofahostimage