I have several Windows servers that the host=$decideOnStartup, but other Windows events correctly provide the Windows host name.
Any ideas why and how to correct this?
Having only splunk stream show "$decideOnStartup" in the hostname of events, while other inputs correctly reflect the real hostname is a known bug in version 7.3.0 and earlier
Issue ID: STREAM-4641, STREAM-4635
When I installed version 7.4.0 and this problem vanished for my system.
I have updated to 7.4 and host still equals $decideOnStartup for all Stream logs. Are there any input.conf file changes required?
Some modular inputs including streamfwd do not respect $decideOnStartup variable.
I think you deleted $SPLUNK_HOME\etc\system\local\inputs.conf file or delete host definition. Normally inputs gets the %COMPUTERNAME% environment variable to use as host field, but stream app.
As a resolution you should create inputs.conf on the forwarders that runs Stream add-on like below sample;
[default] host = system_hostname