Getting Data In

clientName vs host name question ?

sieutruc
Contributor

Hello,

I get confused between clientName (in deploymentclient.conf) and host (in inputs.conf).
Can i use clientName instead of host when sending data to the receiver ? is clientName set as host of the events that will be indexed at indexer ?

Because i have to filter the client machine according to each kind of Windows , so i name each of such kind as client[WinsVersion]. i set clientName like that to register with deployment server. Now for routing these events, how can i use clientName as host of those machines ?

Tags (1)

bwooden
Splunk Employee
Splunk Employee

When a deployment server receives a request from a deployment client, it will attempt to place it in one or more serverclasses by evaluating this information in the following order (machine types are also evaluated, but we'll ignore that for purposes of this conversation)

  1. clientName (attribute from client's deploymentclient.conf)
  2. ip address
  3. host name (as determined via dns)
  4. host name (as determined by client)

The host value in inputs.conf does not come into play here.

The default value of clientName in deploymentclient.conf is deploymentClient. If you're overriding that with a custom choice, you can reference that value in the serverclass.conf of your deployment server's whitelists and blacklists.

bwooden
Splunk Employee
Splunk Employee

You can push configurations to those clients by building apps in deployment-apps and assigning them to a serverClass matching your clientName. It would be undesirable to update host name in inputs.conf for this purpose (and would not affect deployment server evaluation as the hostname reported is not pulled from inputs.conf). We generally want to keep the host value in inputs.conf unique to represent the host of the individual machine so we can distinguish between hosts in search language.

0 Karma

sieutruc
Contributor

So do you know how to set automatically host in inputs.conf as clientName that i set for the deployment client ?

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...