Are you changing the hostname field in the Splunk code or is this configurable? I thought, "Host Name" on Forwarder Management page, was hostname shortname set in inputs.conf, even if you configured host=$decideOnStartup and hostnameOption = fullyqualifiedname for Windows. But it is not. The Host Name in Forwarder Management is the same as you would get using the hostname shell command in both *nix and Windows. It is very useful to see the real hostname together with Client Name (which is either GUID by default or coming from deploymentclient.conf) and Instance Name (which is serverName in server.conf). Also, if you edit clients in a Serverclass, you will see something called DNS Name. It is equivalent to DNS response on Deployment Server e.g. using shell command nslookup <hostname>. (The Deployment Server does a reverse lookup using the IP address of the incoming TCP packets. If it fails, DNS Name will have the IP address instead.) I have not seen any proper documentation of all these different names anywhere, so this is an area with lots of misunderstandings. Servers with Forwarders installed on easily gets incorrect host name and serverName once servers are cloned or renamed, which happens all the time. It can easily be a mess.
... View more