- Splunk Answers
- :
- Splunk Administration
- :
- Security
- :
- Re: How to change the instance and machine name wi...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a Splunk server that acts as a Monitoring Console for my indexer. I wanted to change the server name of the server with the Monitoring Console, both in inputs.conf and server.conf. After I did so and restarted the instance it will no longer connect to my indexer over REST, and thus information in the Monitoring Console is missing. The error I'm getting is that the authentication token is wrong.
Is there a way of changing the server name on my Monitoring Console without getting authentication errors?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I figured out a way to fix the authentication failure. Although both the pass4SymKey and sslPassword remained the same after the server name change, even if I deleted them and restarted the machine to generate new ones, the Monitoring Console couldn't authenticate to the indexer. To solve it I had to go in the UI to settings > distributed search > search peers > indexer. There I had to re-validate the password for the Splunk admin account used for REST. For some reason the password is deleted (?) when the server name of the Monitoring Console instance is changed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I figured out a way to fix the authentication failure. Although both the pass4SymKey and sslPassword remained the same after the server name change, even if I deleted them and restarted the machine to generate new ones, the Monitoring Console couldn't authenticate to the indexer. To solve it I had to go in the UI to settings > distributed search > search peers > indexer. There I had to re-validate the password for the Splunk admin account used for REST. For some reason the password is deleted (?) when the server name of the Monitoring Console instance is changed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi. After changing the hostname on OS everthing worked fine. It wasn't before I manually changed the server name in the config files afterwards problems came up. On the OS level I can still ping the machines from eachother.
The error messages I'm getting are the following.
WARN GetRemoteAuthToken - Unable to get authentication token from peeruri="https://indexer:8089/services/admin/auth-tokens"
WARN DistributedPeer - Peer: https://indexer:8089 Failed to get server info from https://indexer:8089/services/server/info response code=401
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After changing serverName in server.conf, did you change pass4SymmKey to plain text password before restarting?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No. I dond't remember ever setting the pass4SymmKey. Pretty sure it's auto generated. Is it a viable solution to just remove the pass4SymmKey after changing the serverName in server.conf, and then restart the instance? Wouldn't the instance then generate a new pass4SymmKey?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi there,
Can you ping your MC from indexer after changing the hostname? Also, what does your splunkd.log say, can you paste the errors?
Routing logs with Splunk OTel Collector for Kubernetes
Welcome to the Splunk Community!
Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM
