As I don't know if this is a bug or intended I'll try to see if anyone know. When doing a new install of the universal forwarder the servername adds a -root for some specific reason. [root@splunktest opt]# rpm -i splunkforwarder-4.2-96430-linux-2.6-x86_64.rpm [root@splunktest opt]# /opt/splunkforwarder/bin/splunk start --accept-license [root@splunktest opt]# /opt/splunkforwarder/bin/splunk show servername Server name: splunktest.domain.com*-root* Looks kinda weird since all my old 4.1.7 forwarders don't append -root to their servernames. ... View more