Getting Data In

Hosts appearing in host list with short and long names

colinj
Path Finder

I've just started adding forwarders to my Splunk indexer and I'm seeing hosts show up twice in the list of hosts. Once in the form:

foo.bar.baz

and then later as

foo

What I'm wondering is:

  1. What causes this?
  2. How do I make sure that everything is indexed with the long host names?

If it makes a difference I do have the *NIX package installed on the indexer and each of the forwarders.

Tags (3)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

I'm not sure that the *nix app has anything to do with this behavior. What specific sources/sourcetypes do you see this behavior exhibited for?

View solution in original post

araitz
Splunk Employee
Splunk Employee

I'm not sure that the *nix app has anything to do with this behavior. What specific sources/sourcetypes do you see this behavior exhibited for?

araitz
Splunk Employee
Splunk Employee

For the syslog sourcetype, Splunk extracts the hostname from the event itself. See this post for some more information:

http://splunk-base.splunk.com/answers/8659/set-hostname-correctly-for-syslog-input-coming-into-forwa...

0 Karma

colinj
Path Finder

It looks like the sourcetype is consistently syslog and in the syslog source only the short name appears. Since I have machines crossing domains my concern is that we could end up with foo.bar.baz being mixed up with foo.qux.baz as they would both be recognized as foo.

Is there a way that I can force the forwarders to use the full hostname for the syslog sourcetype? Something like this:

[sourcetype=syslog]
host=`hostname`

Just to keep the config files as simple as possible.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...