Getting Data In

Where does host come from in the Universal Forwarder?

Contributor

With previous Splunk installations, at install time, the hostname was written to etc/system/local/inputs.conf. That doesn't appear to be created by the Universal Forwarder.

Where does the hostname come from with the Universal Forwarder?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

It is set when the forwarder starts by executing the hostname command. In previous versions, the same command was run on first-time run of Splunk, and the result written into the inputs.conf file.