Splunk Search

log hostname in metrics.log

datacenter
New Member

In a distributed deployment on the indexer in metrics.log there are logged 2 fields: sourceHost and sourceIp. In my setup they are identical. The IP is logged in both fields. What do I have to configure to log the hostname as well (on the universal forwarders I think)?

Tags (1)
0 Karma

datacenter
New Member

[tcpout: _9700]
server = :9700

[tcpout-server://:9700]

[tcpout]
defaultGroup = _9700
disabled = false

0 Karma

datacenter
New Member

Yes serverName is set to hostname in server.conf. We although set the hostname in inputs.conf (host = ).

0 Karma

MarioM
Motivator

what is in the UF outputs.conf?

0 Karma

MarioM
Motivator

Have you tried to modify the following in $SPLUNK_HOME/etc/system/local/server.conf :

[general]
serverName = <ascii string>
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...