Splunk forwarder configuration - set the default host name when using a deployment server?

[msarro]

Hey everyone. We are working to get a deployment server up and running. However our original manual configurations include in the inputs.conf file a host= field, which specifies the server FQDN (each server one has several, and due to geographical redundancy we have some servers which have the same shortname but different fqdns). We can't use those files with the deployment server since they'd only be valid on a single server.

So can that be manually configured in another file at install time of the forwarder in another configuration file? We've looked at modifying server.conf's serverName= field, but that doesn't appear to make any difference.

[adamw]

When configuring the splunk deployment client, you can set

clientName =

in deploymentclient.conf as the hostname of the particular client to be sent to the deployment server. This would allow you to create stanzas in serverclass.conf to web-1.domain.com, even though the actual hostname on this particular server might be web.domain.com

Thanks,
--adam

[echalex]

So, in the configuration distributed by the deployment server, are you specifying host= in inputs.conf? I think first thing is to remove that.

What will work is specifying host=<fqdn> in etc/system/local/inputs.conf.

This is also set by Splunk when installing. However the name used is whatever is returned by the hostname command. So before installing splunk, you need your /etc/hosts set up to specify the FQDN as hostname, or use DNS. If you already installed splunk, or if you can't change the hots's configs, edit etc/system/local/inputs.conf manually.