https://community.splunk.com/t5/Getting-Data-In/Hostname-macro-in-inputs-conf/m-p/466589#M80386 <P>Ok, to answer my own question...<BR /> In contrast to what I assumed, <STRONG>$decideOnStartup</STRONG> is resolved to the real hostname and not the referenced address of the input like the default for host.</P> Tue, 17 Dec 2019 14:34:06 GMT afx 2019-12-17T14:34:06Z https://community.splunk.com/t5/Getting-Data-In/Hostname-macro-in-inputs-conf/m-p/466588#M80385 <P>Hi,<BR /> I have a Linux based application server that exists in two copies on xhostA and xhostB.<BR /> I am getting their syslog output via a localhost syslog interface into the UF which is installed on those hosts.</P> <P>I do not want to push individual inputs.conf files. So how to I get the appropriate host name for the syslog input?<BR /> If I leave host emtpy, I get 127.0.0.1 which is not helpful. When I set the hostname, it then is identical for both systems.</P> <PRE><CODE>[udp://127.0.0.1:8514] connection_host = 127.0.0.1 sourcetype=linux_secure no_appending_timestamp = true index= xauth </CODE></PRE> <P>Any ideas on how to rectify this easily?<BR /> I assume that</P> <PRE><CODE>host=$decideOnStartup </CODE></PRE> <P>would just deliver 127.0.0.1 as leaving host empty results in this.</P> <P>thx<BR /> afx</P> Tue, 17 Dec 2019 12:55:13 GMT https://community.splunk.com/t5/Getting-Data-In/Hostname-macro-in-inputs-conf/m-p/466588#M80385 afx 2019-12-17T12:55:13Z https://community.splunk.com/t5/Getting-Data-In/Hostname-macro-in-inputs-conf/m-p/466589#M80386 <P>Ok, to answer my own question...<BR /> In contrast to what I assumed, <STRONG>$decideOnStartup</STRONG> is resolved to the real hostname and not the referenced address of the input like the default for host.</P> Tue, 17 Dec 2019 14:34:06 GMT https://community.splunk.com/t5/Getting-Data-In/Hostname-macro-in-inputs-conf/m-p/466589#M80386 afx 2019-12-17T14:34:06Z