Why does the Host name in deployment server appears many times with different client names?

[StuartMacL]

A new entry appears every few days in the Forwarder Management area. Phone homes are only working for the latest entry.

Same Host Name, same IP Address, only the Client Name is different.

Any ideas?

[Simple_Search]

Two items to check -

1. Within the deploymentclient.conf file within the etc\system\local folder, there is a ClientName field that could be added.

2. The following SPL will identify duplicate entries coming in from different machines

index=* host=*
| dedup ComputerName
| rex field=ComputerName "(?<host_name>[^.]+)\."
| stats count(host_name), values(host_name) by host
| sort -count(host_name)
| where count > 1
| rename host as "Computer Name" "count(host_name)" as "Record Count" values(host_name) as "Affected Machines"

[gcusello]

Hi @StuartMacL ,

check if the server hostname is the same of $SPLUNK_HOME/etc/system/local/server.conf.

Ciao.

Giuseppe