Splunk Search

2 host with the same names

sh_tavousi
Explorer

Hi,

I have 2 servers with the same names and I have installed universal forwarder on both servers. In forwarder management I have an issue that sometimes I can see one server another time I can see the other one. How Can I solve this problem to see both of them ?

Can I change name of one of the hosts before sending logs to indexers?

Thanks,

Shohre

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sh_tavousi,

the best thing it should be to change the hostname on one of them!

Anyway, you can change hostname in Splunk Universal forwarder.

You have to modify two conf files in one of the servers:

in $SPLUNK_HOME/system/local/inputs.conf modify

[default]
host = your_server_name

in $SPLUNK_HOME/system/local/server.conf modify

[general]
serverName = your_server_name

Ciao.

Giuseppe

0 Karma