Splunk Search

splunk search and changed domaincontroller name

ESIMatNeforce
Path Finder

Hello,
I have recently changed the computername of my Domaincontroller. When I make a splunk search with "failed password" I get the logs with some attributes of the old hostname and some of the new one:

dest_nt_host W2012R2SrvDC.splunktest.local

dvc WIN-2LUN2OJR0JR

dvc_nt_host WIN-2LUN2OJR0JR

host WIN-2LUN2OJR0JR

The new computername is W2012R2SrvDC. Why does Splunk still has the old computername in the found logs? (the logs are newly created) and how can I fix this issue?

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Sounds like on the initial setup of this host you have a constant value for the host field value in the Splunk configuration and you just need to change that.

In the inputs.conf do you have an entry assigning the hostname like this?

[monitor:///whatever/log1]
host = abc.mydomain.com

0 Karma

ESIMatNeforce
Path Finder

thanks, but thats not a solution to my problem
i have searched all config files on my splunk system, but there is nowhere a hardcoded "WIN-2LUN2OJR0JR" in it

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...