Deployment Architecture

Deploy Server showing incorrect Deploy Client hostname:

ppacheco
Explorer

I am using splunk 4.3 in Amazon's ec2. I have used the "./splunk set servername" and restarted on all of the clients. But using "./splunk list deploy-clients" on the deploy server shows the ec2 internal hostname for all but a few hosts. A couple of outliers are properly showing the name as defined by "./splunk set servername", but I can't seem to figure out why about 5 percent of the hosts are working. On the deploy server, I've tried "./splunk refresh deploy-clients" with no change. I've tried resetting the servername as well as the default-hostname on the clients then refreshing on the deploy server, to no avail. I also confirmed that on both a working host and a non-working host the server.conf file looks the same.

Going to the logs, I see the entry in splunkd.log on the working host is like this:
05-09-2012 18:27:09.422 +0000 INFO ServerConfig - My hostname is "reportdb.us-east-1.foo.com".

On a non-working host is like this:
06-14-2012 21:26:58.769 +0000 INFO ServerConfig - My hostname is "ip-10-124-193-41".

How do I force the deploy server to see the desired hostname so that I can get server classes working?

Tags (2)
0 Karma

ppacheco
Explorer

I had it in my head that the "splunk set servername" was supposed to provide this name, but it does not. After some grinding, I discovered that the "My hostname is" mentioned above, comes from the system file /etc/hostname. So I used the UNIX command "hostname myname.splunk.com" to set the hostname, restarted the splunkforwarder on the client, then ran "./splunk refresh deploy-clients" on the deploy server and it worked. I am now able to use host name directives in serverclass.conf.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...