Splunk Search

log hostname in metrics.log

datacenter
New Member

In a distributed deployment on the indexer in metrics.log there are logged 2 fields: sourceHost and sourceIp. In my setup they are identical. The IP is logged in both fields. What do I have to configure to log the hostname as well (on the universal forwarders I think)?

Tags (1)
0 Karma

datacenter
New Member

[tcpout: _9700]
server = :9700

[tcpout-server://:9700]

[tcpout]
defaultGroup = _9700
disabled = false

0 Karma

datacenter
New Member

Yes serverName is set to hostname in server.conf. We although set the hostname in inputs.conf (host = ).

0 Karma

MarioM
Motivator

what is in the UF outputs.conf?

0 Karma

MarioM
Motivator

Have you tried to modify the following in $SPLUNK_HOME/etc/system/local/server.conf :

[general]
serverName = <ascii string>
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...