Monitoring Splunk

Monitoring Console shows all SHC members with the same instance name

edwardrose
Contributor

Hello All

 

I added our ES SHC to our monitoring console and the instance(host) name is all the same for all 3 search head cluster nodes.  The instance host (servername) are all unique.  How do I resolve this issue?

thanks

ed

Labels (2)
0 Karma
1 Solution

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

View solution in original post

0 Karma

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

0 Karma

edwardrose
Contributor

But why did it change?

0 Karma

Vardhan
Contributor

Hi,

Can run the below command in all the search heads and see what is the result it is showing?

./splunk show server name

./splunk show default-hostname

0 Karma

edwardrose
Contributor

@Vardhan 

Here is the output from the hosts:

splunk@splk-es-app-01:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-01
splunk@splk-es-app-01:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-01:~>

splunk@splk-es-app-02:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-02
splunk@splk-es-app-02:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-02:~>

splunk@splk-es-app-03:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-03
splunk@splk-es-app-03:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-03:~>

 

It appears that all of them have the same default-hostname.

 

thanks

ed

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...