Why is host=$decideOnStartup for Splunk Stream, but not other events?

[dokaas_2]

I have several Windows servers that the host=$decideOnStartup, but other Windows events correctly provide the Windows host name.  

Any ideas why and how to correct this?

[Dave_Splunk]

Having only splunk stream show "$decideOnStartup" in the hostname of events, while other inputs correctly reflect the real hostname is a known bug in version 7.3.0 and earlier

 https://docs.splunk.com/Documentation/StreamApp/7.3.0/ReleaseNotes/Knownissues 

Issue ID: STREAM-4641, STREAM-4635

When I installed version 7.4.0 and this problem vanished for my system.

[Recyclops]

I have updated to 7.4 and host still equals $decideOnStartup for all Stream logs.  Are there any input.conf file changes required?

[scelikok]

Hi @dokaas_2,

Some modular inputs including streamfwd do not respect $decideOnStartup variable. 

I think you deleted $SPLUNK_HOME\etc\system\local\inputs.conf file or delete host definition. Normally inputs gets the %COMPUTERNAME% environment variable to use as host field, but stream app.

As a resolution you should create inputs.conf on the forwarders that runs Stream add-on like below sample;

[default]
host = system_hostname