The value that changes the "server name" is under the server.conf file. Changing the name should be done in two places, inputs.conf and server.conf. The "host name" value is taken from the server, when the server was first created or changed at the OS level. There isn't a splunk config file that will change the "host name" value. Second, the data coming from the UF, will have the "server name" when it reaches the indexer and can be searched by host="mlp-da02" as in the example above. ... View more