Issue after installing Splunk Enterprise 10.2.2 for macOS

[ChrisTahoe]

After a complete install of Splunk Enterprise 10.2.2 for macOS, was about to launch it then I had this error:

ERROR: serverName (if not an IPv6 address) can only contain letters, numbers, underscores, dots, and dashes.  You have: ce:2b:15:...

How and where can I change this ServerName? 

Thanks for your help in advance

. 

[isoutamo]

I'm expecting that you have Intel Mac not M-series version?

If you have M-series, then there is currently only UF version for it. Earlier there was beta for M series, but it has ended by 1.4. and at least I haven't have heard anything new after it.

So currently only option to run splunk on M-series is run it under docker with correct emulation (works at least with splunk 9.x). I haven't tried this yet for 10.x as I have run that beta until now.

For some unknown reason your hostname seems to be ethernet mac address? You can check it with command ifconfig en0 (or it your primary interface is something else use it).

You have two options.

1. Change you host name on OS level to something reasonable 
2. Set it in Splunk's config file
   1. server.conf
      1. serverName = WhatEverYouWant
   2. inputs.conf
      1. host = WhatEverYouWant

[livehybrid]

Hi @ChrisTahoe 

There is limited support for Splunk 10.2 on MacOS (https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/10.2/plan-your-splunk-e...) however this does sound like a bug to me.

Anyway, you should be able to edit the server name in /Applications/Splunk/etc/system/default/server.conf

[general]
serverName=YourHostName

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing