DNS lookup failed for "$decideOnStartup": Host not found (authoritative)

[beginne_Splunk]

When 'tail -f /opt/streamfwd/var/log/streamfwd.log' is executed

Why do I get the following message?

WARN [140610710128384] (HTTPRequestSender.cpp:1485) stream.SplunkSenderHTTPEventCollector - (#0) DNS lookup failed for "$decideOnStartup": Host not found (authoritative)
WARN [140610710128384] (HTTPRequestSender.cpp:1470) stream.SplunkSenderHTTPEventCollector - (#0) Recovery attempt failed

[Jcath]

i have solved this problem. It is because i hadn't change my hostname on httpinput. The way to do this is:

- Go to "/etc/apps/splunk_httpinput/local/inputs.conf" on your splunk enterprise

- add this code line to change your hostname:

[default]

host = <your-IP>

- restart splunk

Hope this helps

[PickleRick]

The error message says clearly "DNS lookup failed" which means that system resolver cannot determine reliably a hostname for the local IP. You can run some packet capture tool to verify what lookup exactly is performed at the start of the UF.

[_JP]

There's several older posts that seem to be related to a default setting not being correct in their case in an etc/system/local/inputs.conf.  I would check through your Splunk configs to see if there's a server name not set correctly, or if an override is in place that is causing it to use a non-existent hardcoded value instead of relying on what the OS thinks the server name is (i.e. look through our .conf files):

Solved: Inputs.conf $decideonstartup - Splunk Community

Why is host=$decideOnStartup for Splunk Stream, bu... - Splunk Community

How to Configure host = $decideOnStartup correctl... - Splunk Community

Solved: $decideOnStartup Remote Perfmon - Splunk Community

[wagenstallerm]

same problem here