topic Re: Why is my server name not displayed as host? in Getting Data In

Why is my server name not displayed as host?

mawomommoh — Thu, 31 May 2018 22:36:26 GMT

I have a UF installed on my local machine and I installed a different UF on a server which I remotely connect to. Whenever I forward files from the remote server it works well but instead of the "host" field value showing as the server name, it shows my local machine name instead. I don't know why this is. Since I am forwarding from the server I expected that the host value will be the server name. Am I missing something? Is there a way to make the host value the server name instead of my local machine name?

Re: Why is my server name not displayed as host?

pradeepkumarg — Thu, 31 May 2018 22:40:40 GMT

how do you know it is actually the server that is sending the data and not your local machine?

can you check any inputs.conf on the forwarder and look for host value if it has been accidentally set to your local machine ?

You can also run this btool command to check which configuration file is taking precdence that has set the host value

$ ./splunk cmd btool inputs list --debug | grep host

Re: Why is my server name not displayed as host?

mawomommoh — Thu, 31 May 2018 23:06:50 GMT

I know it is the server because I remotely connect to the server (using Remote Desktop Connection) and I create the file I want to be forwarded on the server and then put in the monitored folder. The created file does not showup on my local machine because I am on the server.

I setup a forwarder on the server, and that is how the file gets forwarded to Splunk. Without the forwarder the file won't go to Splunk. That shows that that forwarder is functioning from the server not my machine.

Re: Why is my server name not displayed as host?

pradeepkumarg — Fri, 01 Jun 2018 02:35:50 GMT

can you check any inputs.conf on the forwarder and look for host value if it has been accidentally set to your local machine ?

You can also run this btool command to check which configuration file is taking precdence that has set the host value

$ ./splunk cmd btool inputs list --debug | grep host

Re: Why is my server name not displayed as host?

mawomommoh — Fri, 01 Jun 2018 09:48:48 GMT

You were right! Host value in inputs.conf was set to my local machine. Thanks!

Re: Why is my server name not displayed as host?

niketn — Fri, 01 Jun 2018 10:14:36 GMT

@mawomommoh I have converted @gpradeepkumarreddy 's comment to answer. Please accept the answer to mark this question as answered!

Re: Why is my server name not displayed as host?

pradeepkumarg — Fri, 01 Jun 2018 14:01:54 GMT

Thanks, I've updated the answer to be more relevant.