All Apps and Add-ons

Why is host=$decideOnStartup for Splunk Stream, but not other events?

Path Finder

I have several Windows servers that the host=$decideOnStartup, but other Windows events correctly provide the Windows host name.  

Any ideas why and how to correct this?

Labels (2)
Tags (3)
0 Karma


Hi @dokaas_2,

Some modular inputs including streamfwd do not respect $decideOnStartup variable. 

I think you deleted $SPLUNK_HOME\etc\system\local\inputs.conf file or delete host definition. Normally inputs gets the %COMPUTERNAME% environment variable to use as host field, but stream app.

As a resolution you should create inputs.conf on the forwarders that runs Stream add-on like below sample;

host = system_hostname


If this reply helps you an upvote is appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!