Getting Data In

What is the best way to fix hostname for windows diskless clients?

conner9
Path Finder

We have a diskless windows infrastructure that has non-writable images. The splunk agent is installed in the image, and the hostname shows up for the diskless clients as $decideonstartup

Any suggestions for best way to get the proper hostname for the events, would be greatly appreciated.

Thanks

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

Do you have a sample of events from these clients that you can provide? If the desired hostname can be found within the forwarded events they can be overridden and set as the event reach the indexer using props.conf and transforms.conf. https://docs.splunk.com/Documentation/Splunk/7.0.1/Data/Overridedefaulthostassignments

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!