When 'tail -f /opt/streamfwd/var/log/streamfwd.log' is executed
Why do I get the following message?
WARN  (HTTPRequestSender.cpp:1485) stream.SplunkSenderHTTPEventCollector - (#0) DNS lookup failed for "$decideOnStartup": Host not found (authoritative)
WARN  (HTTPRequestSender.cpp:1470) stream.SplunkSenderHTTPEventCollector - (#0) Recovery attempt failed
The error message says clearly "DNS lookup failed" which means that system resolver cannot determine reliably a hostname for the local IP. You can run some packet capture tool to verify what lookup exactly is performed at the start of the UF.
There's several older posts that seem to be related to a default setting not being correct in their case in an etc/system/local/inputs.conf. I would check through your Splunk configs to see if there's a server name not set correctly, or if an override is in place that is causing it to use a non-existent hardcoded value instead of relying on what the OS thinks the server name is (i.e. look through our .conf files):