https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14632#M88349 <P>Is there anyway I could verify if there is any variable which could be used to extract hostname for inputs.conf? instead of explicitly mentioning hostname, I need to push the input.conf file to a set of systems...</P> Wed, 02 Jun 2010 06:56:31 GMT heterodyned 2010-06-02T06:56:31Z https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14632#M88349 <P>Is there anyway I could verify if there is any variable which could be used to extract hostname for inputs.conf? instead of explicitly mentioning hostname, I need to push the input.conf file to a set of systems...</P> Wed, 02 Jun 2010 06:56:31 GMT https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14632#M88349 heterodyned 2010-06-02T06:56:31Z https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14633#M88350 <P>Well. In a standard install, the first time Splunk is run, it executes <CODE>hostname</CODE> and puts the result into <CODE>$SPLUNK_HOME/etc/system/local/inputs.conf</CODE> as the default hostname. That is what will be used for all inputs from this local machine unless otherwise specified or overridden. If that doesn't work for you then, at least as of 4.1.2, you'll have to figure out a way to regenerate the value in that file separately from any Splunk functionality.</P> Wed, 02 Jun 2010 16:57:29 GMT https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14633#M88350 gkanapathy 2010-06-02T16:57:29Z https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14634#M88351 <P>By default it is taking the IP of that system, although the fqdn is ssomething like : abcd.xyz.com, is there anyway I should be overwriting the hostname, like some default variable..</P> Thu, 03 Jun 2010 05:06:06 GMT https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14634#M88351 heterodyned 2010-06-03T05:06:06Z https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14635#M88352 <P>hostname is defined in the $SPLUNKHOME/etc/system/local/inputs.conf. If you want to push out a standard inputs.conf to multiple splunk instances you have a few options:</P> <OL> <LI>Use a deployment server, creating a new app with your inputs.conf to be shipped out. A little bit up front setup time, but easy to manage many hosts. <A href="http://www.splunk.com/base/Documentation/latest/Admin/Aboutdeploymentserver" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Aboutdeploymentserver</A></LI> <LI>If you want to manually (or via script) do this, simply place the inputs.conf into $SPLUNKHOME/etc/apps/search/local. The inputs.conf at this location does not define the hostname, so you don't have to worry about overwriting it by accident or setting it yourself.</LI> </OL> <P>Take a look at the configuration file reference in the documentation, this should make a lot more sense then. <A href="http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles" rel="nofollow">http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles</A></P> Wed, 16 Jun 2010 20:07:48 GMT https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14635#M88352 ftk 2010-06-16T20:07:48Z https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14636#M88353 <P>thank you so much, i think this is what i was looking for, i am going to be working to use this feature for scaling the updated conf files...</P> Sun, 27 Jun 2010 18:45:35 GMT https://community.splunk.com/t5/Getting-Data-In/hostname-in-inputs-conf/m-p/14636#M88353 heterodyned 2010-06-27T18:45:35Z