Monitoring Splunk

Monitoring Console shows all SHC members with the same instance name

edwardrose
Contributor

Hello All

 

I added our ES SHC to our monitoring console and the instance(host) name is all the same for all 3 search head cluster nodes.  The instance host (servername) are all unique.  How do I resolve this issue?

thanks

ed

Labels (2)
0 Karma
1 Solution

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

View solution in original post

0 Karma

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

0 Karma

edwardrose
Contributor

But why did it change?

0 Karma

Vardhan
Contributor

Hi,

Can run the below command in all the search heads and see what is the result it is showing?

./splunk show server name

./splunk show default-hostname

0 Karma

edwardrose
Contributor

@Vardhan 

Here is the output from the hosts:

splunk@splk-es-app-01:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-01
splunk@splk-es-app-01:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-01:~>

splunk@splk-es-app-02:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-02
splunk@splk-es-app-02:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-02:~>

splunk@splk-es-app-03:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-03
splunk@splk-es-app-03:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-03:~>

 

It appears that all of them have the same default-hostname.

 

thanks

ed

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...