Getting Data In

Will Splunk update the host field in indexed events if a universal forwarder's system name is changed?

john_dagostino
Path Finder

So after months of battling an issue with our indexers dropping connections, we determined that there was a problem with the indexers performing reverse DNS lookups for the connecting servers. To mitigate, we added 'connection_host = none' to the inputs.conf resolving the issue.

If I understand how the host field in the indexed events is populated correctly, with 'connection_host = none' set on the indexers we will now rely on the 'host = ' field in inputs.conf on the UF's. I know this value is automatically populated with the server name when Splunk is first installed, however what happens if a server is renamed? Will it modify the inputs.conf to replace the 'host =' field with the new server name?

0 Karma

somesoni2
Revered Legend

It won't. You can change the default host fields name using method described here:

https://answers.splunk.com/answers/154999/how-can-i-change-the-default-hostname-in-splunk.html

john_dagostino
Path Finder

With several thousand forwarders it seems that the risk of having an incorrectly named host would be high. Is there a better way to manage this other than reverse DNS lookup?

Any idea what does the following setting in inputs.conf does?

host =
* If set to '$decideOnStartup', will be interpreted as hostname of executing
machine; this will occur on each splunkd startup.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...