Deployment Architecture

Deploy Server showing incorrect Deploy Client hostname:

ppacheco
Explorer

I am using splunk 4.3 in Amazon's ec2. I have used the "./splunk set servername" and restarted on all of the clients. But using "./splunk list deploy-clients" on the deploy server shows the ec2 internal hostname for all but a few hosts. A couple of outliers are properly showing the name as defined by "./splunk set servername", but I can't seem to figure out why about 5 percent of the hosts are working. On the deploy server, I've tried "./splunk refresh deploy-clients" with no change. I've tried resetting the servername as well as the default-hostname on the clients then refreshing on the deploy server, to no avail. I also confirmed that on both a working host and a non-working host the server.conf file looks the same.

Going to the logs, I see the entry in splunkd.log on the working host is like this:
05-09-2012 18:27:09.422 +0000 INFO ServerConfig - My hostname is "reportdb.us-east-1.foo.com".

On a non-working host is like this:
06-14-2012 21:26:58.769 +0000 INFO ServerConfig - My hostname is "ip-10-124-193-41".

How do I force the deploy server to see the desired hostname so that I can get server classes working?

Tags (2)
0 Karma

ppacheco
Explorer

I had it in my head that the "splunk set servername" was supposed to provide this name, but it does not. After some grinding, I discovered that the "My hostname is" mentioned above, comes from the system file /etc/hostname. So I used the UNIX command "hostname myname.splunk.com" to set the hostname, restarted the splunkforwarder on the client, then ran "./splunk refresh deploy-clients" on the deploy server and it worked. I am now able to use host name directives in serverclass.conf.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...