Monitoring Splunk

Monitoring Console shows all SHC members with the same instance name

edwardrose
Contributor

Hello All

 

I added our ES SHC to our monitoring console and the instance(host) name is all the same for all 3 search head cluster nodes.  The instance host (servername) are all unique.  How do I resolve this issue?

thanks

ed

Labels (2)
0 Karma
1 Solution

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

View solution in original post

0 Karma

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

0 Karma

edwardrose
Contributor

But why did it change?

0 Karma

Vardhan
Contributor

Hi,

Can run the below command in all the search heads and see what is the result it is showing?

./splunk show server name

./splunk show default-hostname

0 Karma

edwardrose
Contributor

@Vardhan 

Here is the output from the hosts:

splunk@splk-es-app-01:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-01
splunk@splk-es-app-01:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-01:~>

splunk@splk-es-app-02:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-02
splunk@splk-es-app-02:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-02:~>

splunk@splk-es-app-03:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-03
splunk@splk-es-app-03:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-03:~>

 

It appears that all of them have the same default-hostname.

 

thanks

ed

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...