Splunk Search

splunk search and changed domaincontroller name

ESIMatNeforce
Path Finder

Hello,
I have recently changed the computername of my Domaincontroller. When I make a splunk search with "failed password" I get the logs with some attributes of the old hostname and some of the new one:

dest_nt_host W2012R2SrvDC.splunktest.local

dvc WIN-2LUN2OJR0JR

dvc_nt_host WIN-2LUN2OJR0JR

host WIN-2LUN2OJR0JR

The new computername is W2012R2SrvDC. Why does Splunk still has the old computername in the found logs? (the logs are newly created) and how can I fix this issue?

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Sounds like on the initial setup of this host you have a constant value for the host field value in the Splunk configuration and you just need to change that.

In the inputs.conf do you have an entry assigning the hostname like this?

[monitor:///whatever/log1]
host = abc.mydomain.com

0 Karma

ESIMatNeforce
Path Finder

thanks, but thats not a solution to my problem
i have searched all config files on my splunk system, but there is nowhere a hardcoded "WIN-2LUN2OJR0JR" in it

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...