Getting Data In

Windows Universal forwarder shows 2 host names for the same server

Path Finder

Hello, We have a single instance splunk deployment. I have installed Universal Forwarder on an Win 2012 R2 Active Directory DC. Upon checking / searching for the events in Splunk Search UI, i noticed it shows 2 different host names for the same DC server. Screenshot below. How to resolve this ? If i click on the 1st host "LAN-AD', it shows events related to CPU, Memory monitoring whereas if i click on the other one, this shows events related to Security Events, Application Event log etc.

alt text

0 Karma

Ultra Champion

Interesting - what does $SPLUNK_HOME/etc/system/local/inputs.conf say on the forwarder? It should have the following -

[default]
host = <host_name>

Path Finder

Thank you Ddrillic. Earlier I was looking at a different inputs.conf ( in a different folder).

0 Karma

Path Finder

Hi, i followed that link but don't see the solution mentioned. I have checked my server.conf and inputs.conf file on my Universal Forwarder. Both do not have any [servername] attribute defined. Where is the UF getting the 2 server names from ?

0 Karma

Influencer

Check the other answer.. I've copy pasted below.

I've seen this usually with syslog (/var/log/syslog)

Syslog is a pre trained sourcetype and extracts the host from within the log itself and if the log has the hostname without FQDN, you see that.

Check the sourcetypes for each of those host entry |tstats count WHERE host=test* by host,sourcetype | stats values(sourcetype) by host

You will see your problematic sourcetype that is causing the host value without FQDN.

0 Karma

Path Finder

Hi Pradeep, Thanks. Earlier I was looking at a different inputs.conf ( in a different folder) and so the confusion. After correcting the "correct" inputs.conf , i am all set.

0 Karma