Hi,
Some month of we moved our Splunk Instance to a new server. The old server was named HQCHMOSS* and the new one is HQCHSPLUNK*. Everything is working fine, but some dashboard such the "Indexing Performance: Instance" in the "Distributed Management Console", the instance list is still displaying the old server name instead of the new one. Therfore the reports shows nothing.
It seems the old server is quite sealed somewhere but where ?
Any ideas?
Thanks,
David
Thankyou everyone that's posted a response here, you gave me various options and areas to check that I'd renamed my server correctly. However I still had no license usage reports as the license master was still finding the old servername somewhere.
The final piece for me was finding the entries in the assets.csv file which corrected the license master name in the Monitoring Console dash/reports....
Hi,
try my Workaround, thats worked for me very well.
doublecheck the instanzename in $SPLUNK_HOME/etc/system/local/server.conf (same as Hostname)
then click on >SETTINGS>MONITORING_CONSOLE
MONITORING_CONSOLE is showing
---click SETTINGS >GENERAL_Setup
---THIS instance
Instance (host) = hostname value, etc
on the top, press "apply changes" verify "YES" (maybe etdit roles temporärly) IMPORTANT press REFRESH
doublecheck Overwie on MC
DONE!
I was having trouble with this too. In my home lab I decided to modify the default hostname under the Index settings (Server settings » General settings) and my monitoring console was still showing the old hostname when I was trying to check my index usage under "Indexes and Volumes: Instance" no matter how many times I applied the change.
I was curious If I could locate this string within the file system so I grep for the string "splunk-3" (my old instance name):
grep -rnw "/opt/splunk/" -e "splunk-3"
This returned a few notable entries:
51,3463,completed,"0.715357022","1514786400.000000000","1514874115.000000000",,"1514786400.000000000","1514874115.000000000",,,,,,,,,,,,,,,,,
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/assets.csv:2:localhost,"splunk-3","splunk-3","splunk-3","dmc_group_indexer",,,,,
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/assets.csv:3:localhost,"splunk-3","splunk-3","splunk-3","dmc_group_kv_store",,,,,
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/assets.csv:4:localhost,"splunk-3","splunk-3","splunk-3","dmc_group_license_master",,,,,
/opt/splunk/etc/apps/splunk_monitoring_console/lookups/assets.csv:5:localhost,"splunk-3","splunk-3","splunk-3","dmc_group_search_head",,,,,
Decided to replace "splunk-3" with my new hostname "
nano /opt/splunk/etc/apps/splunk_monitoring_console/lookups/assets.csv
peerURI,serverName,host,machine,"search_group","mv_peerURI","mv_serverName","mv_host","mv_machine","__mv_search_group"
localhost,"splunk-index1","splunk-index1","splunk-index1","dmc_group_indexer",,,,,
localhost,"splunk-index1","splunk-index1","splunk-index1","dmc_group_kv_store",,,,,
localhost,"splunk-index1","splunk-index1","splunk-index1","dmc_group_license_master",,,,,
localhost,"splunk-index1","splunk-index1","splunk-index1","dmc_group_search_head",,,,,
Returned to the monitoring console and refreshed the page, monitoring console is working as intended. Keep in mind I am using a trial license in my home lab and don't suggest doing this in a prod environment without proper testing... Finished by restarting Splunk and verifying still getting data in and indexing properly.
hi,
i got the same Issue. for me works following workaround.
doublecheck the instanzename in $SPLUNK_HOME/etc/system/local/server.conf (same as Hostname)
then click on >SETTINGS>MONITORING_CONSOLE
MONITORING_CONSOLE is showing
---click SETTINGS >GENERAL_Setup
---THIS instance
Instance (host) = hostname value, etc
on the top, press "apply changes" verify "YES" (maybe etdit roles temporärly) IMPORTANT press REFRESH
doublecheck Overwie on MC
DONE!
After making changes and letting them persist for awhile I restarted the DMC - this did not change the instance name to the configured new instance name even after a restart of the DMC. I then applied all changes - and that did the trick!
Apply Changes on DMC -> Settings -> General Setup
I was able to get my DMC working correctly by using the Reset All Settings button in the DMC > Settings > General Settings menu. This did reset everything else in DMC but it's working properly now.
I downvoted this post because there needs to be a better way to accomplish this. for a small/new environment this is fine but when you have 50+ devices this isn't a viable solution.
Thank you Sheron.,
I just used your commandline and the "serverName" configured in the server.conf, is set to the new server name.
In fact, everything indexed by this machine is correctly stamped with host=[CORRRECTSERVERNAME] . I am facing only a issue with the Distributed Management Console which is listing the instances with the incorrect/previous naming.
Best regards,
David Campillo
In the gui, look at Settings > Server settings > General Settings and make sure the Splunk Server Name and the Default Host Name are correct.
if you have command line access, you can try using btool and locate the old server name:
$SPLUNK_HOME/bin/splunk btool server list --debug