I have a universal forwarder (4.2.2) setup that sends text logs, event logs and WMI counters.
When the data gets indexed on our indexer, the host field for everything but WMI data shows "abc123" (lowercased) and the WMI data will be "ABC123" (uppercased).
The inputs.conf file has a host setting of "abc123" and server.conf has the same. The server hostname is also "abc123"
Why does WMI data show up with the hostname capitalized? Is it a bug in the version of UF that I'm running?
Can you check your Universal Forwarder's
etc\system\local\server.conf setting for
serverName? If it is the hostname in capital letters, change it to lowercase, restart Splunk, and see if it makes a difference.
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!