With previous Splunk installations, at install time, the hostname was written to etc/system/local/inputs.conf. That doesn't appear to be created by the Universal Forwarder.
Where does the hostname come from with the Universal Forwarder?
It is set when the forwarder starts by executing the hostname command. In previous versions, the same command was run on first-time run of Splunk, and the result written into the inputs.conf file.
