Getting Data In
Highlighted

Where does windows get its host field from?

Motivator

I have a few windows machines Light Forwarding in to a central indexer, sending just WinEventLogs for now. For most hosts, its events' ComputerName is the same as the host field. For a couple, it's not.

It's causing confusion as server A, which shows up at ComputerName A in its events, comes through with a host field of B, the name of a different existing server not currently running a Splunk forwarder.

Where does Splunk on Windows get its host: field from, and can it be explicitly be overridden?

Tags (2)
Highlighted

Re: Where does windows get its host field from?

Splunk Employee
Splunk Employee

can you show us your monitor stanzas in inputs.conf?

0 Karma
Highlighted

Re: Where does windows get its host field from?

Motivator

Not currently, due to other things happening on the server right now. Probably later.

Would this be affected by inputs.conf? This had the same splunk install package installed on it as other servers which are correctly reporting their ComputerName as host.

0 Karma
Highlighted

Re: Where does windows get its host field from?

Splunk Employee
Splunk Employee

The Host field in events coming from Windows Event Logs is set by the value in "ComputerName" field. To overwrite this, set the value of the Host field in etc\apps\windows\local\inputs.conf You can set it globally under the [default] stanza, or you can set it individually for each Event Log channel:

[WinEventLog:Application]
host = host.ad.com
...
Highlighted

Re: Where does windows get its host field from?

Splunk Employee
Splunk Employee

A Splunk server (including a forwarder) will always have the default "host" value set in $SPLUNK_HOME\etc\system\local\inputs.conf by first-time run. The value is set to the result of the hostname command run on the machine at that time. This can be changed or overridden in another inputs.conf globally or by stanza, but unless this is done, WinEventLogs will end up using this value.

Highlighted

Re: Where does windows get its host field from?

Splunk Employee
Splunk Employee

If logs are collected via WMI (not likely in the case of LWF), the host will be set to the value of the ComputerName field.

0 Karma
Highlighted

Re: Where does windows get its host field from?

Splunk Employee
Splunk Employee

Yes, inputs.conf can and will affect it. See Ledio's post below.
I cant tell why it switches from one host to another though.. You are not grabbing event logs from CPNameB through WMI or anything else, are you?

0 Karma
Highlighted

Re: Where does windows get its host field from?

Contributor

I've been affected by and tracking this issue for more than a year. There doesn't seem to be any good answer (this isn't one either I'm afraid), and windows hosts seem to return an essentially random host value based on the computer name somehow :-).

Can we please have a proper solution to this in the windows app, which allows the user at setup-time to require ALL events to be indexed with either FQDN or computer name, or at any rate ONE VALUE PER COMPUTER. I've seen 'solutions' which range from hard-coding the name in inputs.conf (which isn't available with WMI anyway), messing around with props and transforms, to rewriting the data at index time. In my experience, Splunk admins can't control how a given windows box has been setup, so we must have a way to work around this reliably and consistently. Many shops, and nearly all the larger ones, are multiplatform, and it's high time that the windows and unix apps behaved the same way. Even in an all-windows site, you will see interesting variations on the hostname, which make searches and UI elements needlessly painful to construct.

Highlighted

Re: Where does windows get its host field from?

Motivator

Certainly submit an Enhancement Request (P4 bug) if not a higher priority bug so Splunk can track requests for this. I have seen these issues at many clients.

0 Karma
Highlighted

Re: Where does windows get its host field from?

Builder

Any traction on the Enhancement Request? Just curious. Thanks.

0 Karma