Universal Forwarder: WMI Hostname Config Ignored

[techfutures]

I am running the Universal Forwarder on a Windows Server pointed to a linux splunk server. I also have a wmi.conf file that is polling another Windows server for additional information via WMI. This is working fine, and I see the other servers logs showing up in splunk...but splunk is ignoring the hostname defined in the WMI config. This means that both the remote polled Win server and the one with the forwarder installed, both use the forwarder's host name.

For example:

    24/03/2011 10:13:12.857     

20110324101312.857327 CSCreationClassName=Win32_ComputerSystem CSName=VADER Caption=conhost.exe CommandLine=\??\C:\Windows\system32\conhost.exe CreationClassName=Win32_Process CreationDate=20110324101309.003906-420 Description=conhost.exe EventClass=InstanceCreationEvent ExecutablePath=C:\Windows\system32\conhost.exe

Show all 50 lines

    **host=BART   Options|**  
    sourcetype=WMI:VaderProcessCreation   Options|  
    source=WMI:VaderProcessCreation   Options

Here is the raw source for this log:

20110324101312.857327
CSCreationClassName=Win32_ComputerSystem
CSName=VADER
Caption=conhost.exe
CommandLine=\??\C:\Windows\system32\conhost.exe
CreationClassName=Win32_Process
CreationDate=20110324101309.003906-420
Description=conhost.exe
--snipped--
WriteTransferCount=0
**wmi_hostname=Vader**
wmi_type=VaderProcessCreation

Notice that the host=BART when it should equal Vader as defined in hostname.

Here is my config for this:

[WMI:VaderProcessCreation]
interval = 1
server = vader
wql = select * from __InstanceCreationEvent within 1 where TargetInstance isa 'Win32_Process'
disabled = 0
current_only = 1
hostname = Vader

This is true for all my WMI polls for this remote server (Vader). Any suggestions as to what is going on?

Thanks,

Robert

[woodcock]

You need to change hostname = Vader to host = Vader.