topic Re: Forwarder's hostname in Getting Data In

Forwarder's hostname

khhenderson — Mon, 14 May 2012 14:07:05 GMT

What is the best way to change the hostname's of the forwarders (Linux)? We have change our naming convention. I changed the entry in the server.conf (serverName = $HOSTNAME), stopped splunkd and then restarted on the forwarder. I checked the "Deployment Monitor" and the newly renamed machine did not show up. The old name was still in the list. I gave it 20 minutes, no change. The "Current Status" for the old name changed to "missing". I was able to search using the new name. Can someone help with step by step procedures?

Re: Forwarder's hostname

briang67 — Mon, 14 May 2012 18:33:56 GMT

Did you try changing the "host = hostname" field in the inputs.conf on the forwarder?

Re: Forwarder's hostname

khhenderson — Mon, 14 May 2012 18:38:17 GMT

There is not a line in my inputs.conf for "host" on the forwarder. It only list the directories to be monitored.

Re: Forwarder's hostname

briang67 — Mon, 14 May 2012 18:41:58 GMT

You can add the field if needed....
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf