We have setup deployment server. It works pretty well but we have problem with one of our systems - We have four machines (windows) where splunk universal forwarders are installed and these four machines are part of a distributed system setup. We have multiple A records for the same domain name. i.e These servers are hit on a round robin basis for load balancing purposes.
I understand the deployment server uses reverse DNS lookup to identify the hostname. ON reverse lookup of each IP of the above machines, you get two records - one is the domain name we have setup for load balancing and the other is the complete hostname(FQDN)
Whenever the deployment server captures the FQDN/hostname as the dns attribute, it is able to push the apps without any issue. But if the domain name we have set for load balancing is captured all apps are wiped off the client machines.
PLease help as we couldnt find any configuration in Splunk to handle this?
