Splunk not collecting logs after hostname rename on configuration file

[OMohi]

Hi:

I had to rename a hostname on splunk client configuration on inputs.conf and server.conf and removed the guid on /etc/instance.cfg to match the hostname of the server with the splunk client configuration in inputs.conf and server.conf files on a linux box. However, I am unable to capture events from the client server. Is there something else I am required to do or re-install Splunk?

Please let me know.

Thanks,

Obaid

[woodcock]

Check out this Q&A:

https://answers.splunk.com/answers/328896/if-we-clone-a-windows-server-with-a-splunk-forward.html#an...

[Lucas_K]

Does that GUID exist on the old server still?

I'm not sure why would would have changed it. For a host rename just change the inputs/server entries and that's it.

Double check that you don't have GUID's in different files that are different. Upon start up splunk will error out.

"If server.conf has a value of 'guid' AND instance.cfg has a value of 'guid'
AND these values are different, startup halts and error is shown. Operator
must resolve this error. We recommend erasing the value from server.conf
file, and then restarting."

http://docs.splunk.com/Documentation/Splunk/6.3.1511/Admin/Instancecfgconf

also

"the instance.cfg file is not to be modified or removed by user. LEAVE THE

instance.cfg FILE ALONE."

I'd hazard a guess that you've now broken your install.