Splunk Enterprise Security

Event from add-on Splunk app Windows source without domain name

ibabansk
Loves-to-Learn

Good afternoon! Splunk Add-on for Microsoft Windows version 8.0.0 Splunk TA Windows, generates a data source without a domain name, i.e. just a host name. How can I bulk configure to display hostname with domain e.g. pc1.domain.com. Use in server.conf - hostnameOption = fullyqualifiedname, you can not because you need to distribute the configuration on a large number of PC
via forwarder manager. Such a setup can be done through props and transformer

Labels (1)
0 Karma

ibabansk
Loves-to-Learn

Thank you for the solution provided, but unfortunately it is not applicable. The thing is that in fact we get two event sources Computer1 and Computer1.local.domain. If you disable Splunk Add-on for Microsoft, all events come from the source Computer1.local.domain

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

This isn't exactly the answer to the question that you've asked, but if you're using Enterprise Security, it sounds like you could possibly use entity zones to help specify your different domains: 
https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Entityzones

Let me know if that helps. 

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...