Getting Data In

Case sensitivity on universal forwarder hostname

Path Finder

I have a universal forwarder (4.2.2) setup that sends text logs, event logs and WMI counters.

When the data gets indexed on our indexer, the host field for everything but WMI data shows "abc123" (lowercased) and the WMI data will be "ABC123" (uppercased).

The inputs.conf file has a host setting of "abc123" and server.conf has the same. The server hostname is also "abc123"

Why does WMI data show up with the hostname capitalized? Is it a bug in the version of UF that I'm running?

Thanks!

0 Karma

Splunk Employee
Splunk Employee

Derek,

Can you check your Universal Forwarder's etc\system\local\server.conf setting for serverName? If it is the hostname in capital letters, change it to lowercase, restart Splunk, and see if it makes a difference.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

0 Karma

Contributor

WMI inputs appear to use the Netbios name, regardless of other settings. A number of questions have been asked on this topic. netbios names are always uppercase.

0 Karma

Path Finder

It's also set to the lowercase version of the hostname.

0 Karma