Last week a large portion of our Windows hosts reported in with a different "host" value. This is causing all sorts of issues with dashboards that think our number of monitored hosts have doubled. The issue we're seeing is that for around a week they all began being logged under their FQDN, not just the host name. (Similar to what was seen here: https://community.splunk.com/t5/Getting-Data-In/Where-does-windows-get-its-host-field-from/m-p/17422...)
I've compared 2 logs from the same host, with the same event ID. The only difference I can see in the logs is that dvc_nt_host is different between the 2, while dvc is the fqdn on both. Which is super off because this line is in the props.conf of the Windows TA app
FIELDALIAS-dvc = host as dvc, host as dvc_nt_host
So it appears that the FQDN is always available, however, sometimes its used and sometimes it is shortened to just the hostname. I've hit a wall trying to work out what is causing this to happen, as no changes have been made to Splunk in the last week.
