Why changing forwarder to deployment client changes host?

[himynamesdave]

RE:

I recently switched our forwarders from being individually managed to deployment clients (as per question here) and encountered one issue: Splunk changed the host value for each event coming from a forwarder to "ID" with all events (indexed as host=ID).

Note, we did not use the deployment server to push down any apps yet, we've only pointed the forwarder at the deployment server (set deploy-poll)

Any ideas as to why this behaviour might happen? I cannot see anything in docs.

[woodcock]

This should not have happened and I would ABSOLUTELY file a support case so that somebody will fix this bug. In the meantime, the problem is almost certainly to be found in server.conf on your forwarder. Find the one that was modified most recently and look around. Check this:

[general]
serverName=

[ddrillic]

Interesting - can't google any similar host=ID case, but the best practice, in my mind, is to explicitly specify the host in the configurations, if possible.