Problem with hostname field for Windows inputs

[erga00]

Has anyone run into this? I've opened a case with Support but I thought I'd ask here as well.

None of the Windows inputs (WMI, perfmon, registry) are setting the proper value in the hostname field. I've set the fully qualified domain name in the hostname parameter of the inputs.conf file (hostname=server.domain.com) however the events have what appears to be the contents of the COMPUTERNAME environment variable (hostname=SERVER).

All other events have the expected hostname value (hostname=server.domain.com).

There's a note in the Release Notes for Splunk 4.2 describing changes to how the default value of hostname is derived. However, the workaround described there is to set the hostname in the inputs.conf as I've done.

I doubt it's something to do with my environment as I've reproduced the problem on a fresh install of Splunk without any custom configs.

I'm using Splunk 4.2.2 on Windows 2008 R2 by the way.

[cmeo]

I've been wrestling with this problem for more than a year (http://splunk-base.splunk.com/answers/28879/host-value-for-windows) and the only response I've had is to make an enhancement request.

AFAIC, splunk does not have to mirror windows' broken behaviour. It is nonsensical to have the same host reporting events under three or four possible hostnames, even if they're related. It adds needless complexity to searches to have to account for the possibilities. There's no way I know of in windows to compel wmi to return the dns name, or if there is I haven't found it yet. Having to configure each wmi input manually is not, in my view, a solution, not to mention that it doesn't seem to work 🙂

It is high time Splunk did something about this, and I see quite a few unanswered questions here on this subject. I'm pretty sure wmi can be asked for the dns name and not the netbios name; should be simple enough to fix.

[cmeo]

I've just noticed another very interesting thing. I ran splunk-wmi.exe to get a better idea of what it does, which isn't that much--just passes wql to the WMI provider. What it does NOT do is return any kind of hostname. So where is that coming from? If this can be changed to something sensible for WMI inputs, all will be well.