2 host with the same names

[sh_tavousi]

Hi,

I have 2 servers with the same names and I have installed universal forwarder on both servers. In forwarder management I have an issue that sometimes I can see one server another time I can see the other one. How Can I solve this problem to see both of them ?

Can I change name of one of the hosts before sending logs to indexers?

Thanks,

Shohre

[gcusello · Accepted solution]

Hi @sh_tavousi,

the best thing it should be to change the hostname on one of them!

Anyway, you can change hostname in Splunk Universal forwarder.

You have to modify two conf files in one of the servers:

in $SPLUNK_HOME/system/local/inputs.conf modify

[default]
host = your_server_name

in $SPLUNK_HOME/system/local/server.conf modify

[general]
serverName = your_server_name

Ciao.

Giuseppe

[gcusello]

Hi @sh_tavousi,

good for you, see next time.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[sh_tavousi]

Hi,

Thank you so much.

Shohre