Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- Splunk Development
- :
- Splunk Dev
- :
- Re: How to change the host name on remote instance...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have Splunk instance (master) from where I need to migrate indexed data to another instance (client). I have archive the indexed data on instance (master) by setting up NFS mount point and copied archived data in thawed bucket on instance (client). Now, I need to retrieve it on my new host (Client).
As, host name of both the machines are different when I retrieved it, it displays older host. name (master's host name).
Where to change host value so that it will show the client instance host name ?
Splunk version using = 6.5.0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When data is indexed in Splunk, the host, source and sourcetype of the data are stored along with the raw events. Once indexed, these values cannot be changed. If what you want to see is the name of the machine that is storing the data, use splunk_server instead of host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When data is indexed in Splunk, the host, source and sourcetype of the data are stored along with the raw events. Once indexed, these values cannot be changed. If what you want to see is the name of the machine that is storing the data, use splunk_server instead of host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
in inputs.conf I need to mention splunk_server?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not in inputs.conf, use splunk_server in your search.
You should set the host name to the correct host in inputs.conf - but this will affect only newly indexed data. Data that has already been indexed will not change.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks... 🙂 its showing the instance name(client server)
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
