Splunk Search

2 host with the same names

sh_tavousi
Explorer

Hi,

I have 2 servers with the same names and I have installed universal forwarder on both servers. In forwarder management I have an issue that sometimes I can see one server another time I can see the other one. How Can I solve this problem to see both of them ?

Can I change name of one of the hosts before sending logs to indexers?

Thanks,

Shohre

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @sh_tavousi,

the best thing it should be to change the hostname on one of them!

Anyway, you can change hostname in Splunk Universal forwarder.

You have to modify two conf files in one of the servers:

in $SPLUNK_HOME/system/local/inputs.conf modify

[default]
host = your_server_name

in $SPLUNK_HOME/system/local/server.conf modify

[general]
serverName = your_server_name

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sh_tavousi,

the best thing it should be to change the hostname on one of them!

Anyway, you can change hostname in Splunk Universal forwarder.

You have to modify two conf files in one of the servers:

in $SPLUNK_HOME/system/local/inputs.conf modify

[default]
host = your_server_name

in $SPLUNK_HOME/system/local/server.conf modify

[general]
serverName = your_server_name

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sh_tavousi,

good for you, see next time.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

sh_tavousi
Explorer

Hi,

Thank you so much.

Shohre

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...