Installation

How to change Hostname of a splunk server

Alan_Bradley
Path Finder

In my environment we make clones of our linux servers so that we don't have to build out a server from scratch for every new project. On my master image, I have configured a splunk forwarder to splunk to our indexer. My question is as I now make a clone for a particular project, all future clones will show up with the same hostname. How do I go about modifying the clone to reflect their new hostnames? Is it a matter of changing configuration files, or some splunk commands against the database? Are there any other considerations to take into account?

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

In a vanilla Splunk configuration (version 4.0), there are only two files that contain the host name: $SPLUNK_HOME/etc/system/local/inputs.conf and $SPLUNK_HOME/etc/system/local/server.conf. These files are generated the first time Splunk is run after installation.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

In a vanilla Splunk configuration (version 4.0), there are only two files that contain the host name: $SPLUNK_HOME/etc/system/local/inputs.conf and $SPLUNK_HOME/etc/system/local/server.conf. These files are generated the first time Splunk is run after installation.

matt
Splunk Employee
Splunk Employee

Before you make a backup/clone, remove "host=" parameter in inputs.conf in local bundles (also check that other configuration file does not contain host= parameter as well). When Splunk starts up on cloned client machine, it should pick up the local machine name and forward it to the indexer.

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...