Deployment Architecture

Linux Servers not showing in Hosts lists

hyoung
New Member

I have added a few Ubuntu Linux server. They are forwarding log data no problem, and I can search it. Problem is that they do not show up as "Hosts" so I can modify queries based on that. How do I tag them as Hosts?

Tags (1)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You shouldn't have to tag your data as Hosts. It is just based on the "host" field that the data is indexed with. When you search for your data, what "host" is set for it?

If you do a search like:

| metadata type=hosts | search host=<host of your data>

What is returned? This is essentially the search used to populate the dashboard.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

You shouldn't have to tag your data as Hosts. It is just based on the "host" field that the data is indexed with. When you search for your data, what "host" is set for it?

If you do a search like:

| metadata type=hosts | search host=<host of your data>

What is returned? This is essentially the search used to populate the dashboard.

hyoung
New Member

It just took a while for the dashboard to populate I guess. I think I was referring to the *NIX app at that time. It still does not show the "Hosts". I have opened another post that is more specific to the problem.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...