Getting Data In

Splunk Forwarder to automatically use FQDN as hostname, how to configure?

xisteam
Explorer

Hi!

How can I configure Splunk Universal Forwarder in Linux to use FQDN - basically the result of hostname -f - as hostname automatically, i.e. without "hard-wiring" the FQDN in any of Splunk's configuration files? If no simple configuration to do this, probably there is a way to do it with a script that triggered every time I start Splunk Forwarder?

I have been using host = $decideOnStartup in inputs.conf, which pick up the hostname of the machine. However for many distro hostname is just the first part of FQDN.

Thank you!

Labels (2)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hi..!!

If you want to use FQDN for the host, you can continue using host = $decideOnStartup in inputs.conf. 

Along with this, you'll need to set below config in server.conf

 hostnameOption=fullyqualifiedname

 More informations related to hostname can be found in server.conf

---
If you find the answer helpful, an upvote/karma is appreciated

xisteam
Explorer

Confirming @mattymo response, unfortunately this does not work, Splunk still only take the short hostname - not FQDN - as hostname.

0 Karma

mattymo
Splunk Employee
Splunk Employee

Looks like `hostnameOption` is Windows only, fyi..

hostnameOption = [ fullyqualifiedname | clustername | shortname ]
* The type of information to use to determine how splunkd sets the 'host' value for a Windows
  Splunk platform instance when you specify an input stanza with 'host = $decideOnStartup'.
* Applies only to Windows hosts, and only for input stanzas that use the
  "host = $decideOnStartup" setting and value.
* Valid values are "fullyqualifiedname", "clustername", and "shortname".
* The value returned for the 'host' field depends on Windows DNS, NETBIOS,
  and what the name of the host is.
  * 'fullyqualifiedname' uses Windows DNS to return the fully qualified host name as the value.
  * 'clustername' also uses Windows DNS, but sets the value to the domain and machine name.
  * 'shortname' returns the NETBIOS name of the machine.
* Cannot be an empty string.
* Default: shortname

  

- MattyMo

SanjayReddy
SplunkTrust
SplunkTrust

Can we also try with 

following option in inputs.conf

[default]
host=<hostnameinfqdn>

0 Karma

xisteam
Explorer

Thanks, but unfortunately this does not work, Splunk still only take the short hostname - not FQDN - as hostname.

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @xisteam 

just for re verification, I have performed same steps  in my personal system mentioned earlier reply,  I am  able to change the host value

under etc/system/local I added follwing   

[default]
host=dummy

[monitor://‪C:\Program Files\Splunk\var\log\splunk\splunkd.log]
disabled = false
sourcetype = test
index = main

restarted  the splunk  

now I am able to updated host name 

SanjayReddy_0-1648052866078.png

 

0 Karma

xisteam
Explorer

Sorry, I think you misunderstood my question. I already knew that specifying a hostname explicitly will work. However, I am interested in having the hostname automatically set - either on Splunk startup or machine startup or more often - to the FQDN of the machine at the time. Therefore if I ever change the hostname of the machine - which we do quite often here - the hostname Splunk uses will automatically changed as well. And Splunk actually have solution for MS Windows (use hostnameinfqdn in server.conf as mentioned above), but that does not work in Linux.

 

0 Karma

xisteam
Explorer

I meant using

hostnameOption=fullyqualifiedname

But it won't work in Linux.

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @xisteam 

try using command 

$SPLUNK_HOME$/bin

./splunk set servername <servername>

it will update server name in server.conf

[general]
serverName = Server1


| rest /services/authentication/users splunk_server=local
| dedup splunk_server
| table splunk_server

SanjayReddy_0-1648366422263.png

I hope you are expcting this ? 

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...