Deployment Architecture

Splunk forwarder configuration - set the default host name when using a deployment server?

msarro
Builder

Hey everyone. We are working to get a deployment server up and running. However our original manual configurations include in the inputs.conf file a host= field, which specifies the server FQDN (each server one has several, and due to geographical redundancy we have some servers which have the same shortname but different fqdns). We can't use those files with the deployment server since they'd only be valid on a single server.

So can that be manually configured in another file at install time of the forwarder in another configuration file? We've looked at modifying server.conf's serverName= field, but that doesn't appear to make any difference.

Tags (1)

adamw
Communicator

When configuring the splunk deployment client, you can set

clientName =

in deploymentclient.conf as the hostname of the particular client to be sent to the deployment server. This would allow you to create stanzas in serverclass.conf to web-1.domain.com, even though the actual hostname on this particular server might be web.domain.com

Thanks,
--adam

0 Karma

echalex
Builder

So, in the configuration distributed by the deployment server, are you specifying host= in inputs.conf? I think first thing is to remove that.

What will work is specifying host=<fqdn> in etc/system/local/inputs.conf.

This is also set by Splunk when installing. However the name used is whatever is returned by the hostname command. So before installing splunk, you need your /etc/hosts set up to specify the FQDN as hostname, or use DNS. If you already installed splunk, or if you can't change the hots's configs, edit etc/system/local/inputs.conf manually.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...