All Apps and Add-ons

Why is host=$decideOnStartup for Splunk Stream, but not other events?

dokaas_2
Path Finder

I have several Windows servers that the host=$decideOnStartup, but other Windows events correctly provide the Windows host name.  

Any ideas why and how to correct this?

Labels (2)
Tags (3)
0 Karma

scelikok
Champion

Hi @dokaas_2,

Some modular inputs including streamfwd do not respect $decideOnStartup variable. 

I think you deleted $SPLUNK_HOME\etc\system\local\inputs.conf file or delete host definition. Normally inputs gets the %COMPUTERNAME% environment variable to use as host field, but stream app.

As a resolution you should create inputs.conf on the forwarders that runs Stream add-on like below sample;

[default]
host = system_hostname

 

If this reply helps you an upvote is appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!