Splunk Search

log hostname in metrics.log

datacenter
New Member

In a distributed deployment on the indexer in metrics.log there are logged 2 fields: sourceHost and sourceIp. In my setup they are identical. The IP is logged in both fields. What do I have to configure to log the hostname as well (on the universal forwarders I think)?

Tags (1)
0 Karma

datacenter
New Member

[tcpout: _9700]
server = :9700

[tcpout-server://:9700]

[tcpout]
defaultGroup = _9700
disabled = false

0 Karma

datacenter
New Member

Yes serverName is set to hostname in server.conf. We although set the hostname in inputs.conf (host = ).

0 Karma

MarioM
Motivator

what is in the UF outputs.conf?

0 Karma

MarioM
Motivator

Have you tried to modify the following in $SPLUNK_HOME/etc/system/local/server.conf :

[general]
serverName = <ascii string>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...