All Apps and Add-ons

Why is host=$decideOnStartup for Splunk Stream, but not other events?

dokaas_2
Path Finder

I have several Windows servers that the host=$decideOnStartup, but other Windows events correctly provide the Windows host name.  

Any ideas why and how to correct this?

Labels (2)
Tags (3)
0 Karma

scelikok
Champion

Hi @dokaas_2,

Some modular inputs including streamfwd do not respect $decideOnStartup variable. 

I think you deleted $SPLUNK_HOME\etc\system\local\inputs.conf file or delete host definition. Normally inputs gets the %COMPUTERNAME% environment variable to use as host field, but stream app.

As a resolution you should create inputs.conf on the forwarders that runs Stream add-on like below sample;

[default]
host = system_hostname

 

If this reply helps you an upvote is appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!