Why do I see the same host twice?

[dmitchell92]

Hello Splunkers,

When I search to see that host are in the appropriate index "index=indexname | stats count by host" I will see the same host listed twice. Once with the hostname of the forwarder and another with the FQDN of the forwarder. I believe that that culprit of this issue is because when engineers install forwards on host, they run "./splunk set forward-server ip_address:9997" then me as the splunk admin will add the sendtoindexer deployment app to the server class. Am I on the right track here or way off basis?

Thanks Splunkers!

[pradeepkumarg]

Check if this helps

https://answers.splunk.com/answers/642834/why-are-there-multiple-host-entries-for-every-splu.html#an...

[dmitchell92]

This helps makes better sense of the culprit. What is best practice so I can eliminate the multiple host reporting? Across our infrastructure we have a unique naming convention so I would prefer everything to not have the FQDN in the host field.