Installation

How to change Hostname of a splunk server

Alan_Bradley
Path Finder

In my environment we make clones of our linux servers so that we don't have to build out a server from scratch for every new project. On my master image, I have configured a splunk forwarder to splunk to our indexer. My question is as I now make a clone for a particular project, all future clones will show up with the same hostname. How do I go about modifying the clone to reflect their new hostnames? Is it a matter of changing configuration files, or some splunk commands against the database? Are there any other considerations to take into account?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

In a vanilla Splunk configuration (version 4.0), there are only two files that contain the host name: $SPLUNK_HOME/etc/system/local/inputs.conf and $SPLUNK_HOME/etc/system/local/server.conf. These files are generated the first time Splunk is run after installation.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

In a vanilla Splunk configuration (version 4.0), there are only two files that contain the host name: $SPLUNK_HOME/etc/system/local/inputs.conf and $SPLUNK_HOME/etc/system/local/server.conf. These files are generated the first time Splunk is run after installation.

matt
Splunk Employee
Splunk Employee

Before you make a backup/clone, remove "host=" parameter in inputs.conf in local bundles (also check that other configuration file does not contain host= parameter as well). When Splunk starts up on cloned client machine, it should pick up the local machine name and forward it to the indexer.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...