No third party certs. The servers are Windows 2016 servers; the forwarders are v9.0.2. The files are $SPLUNK_HOME\etc\auth\server.pem.pfx I tried having the admin read the info off the files using "certutil -dump" and "openssl pkcs12", but they are asking for a password. Finally, the admin renamed the file and restarted the splunkforwarder service; seems to run fine without them. ... View more

Mine are Windows 2016 servers; the forwarders are v9.0.2. Is this part of some new security feature? I can't find anything about them in the documentation. ... View more

I've got the same problem; did you ever figure it out? ... View more

I just went to the app in manage apps, viewed the objects, found the aforementioned field alias and unchecked the "Overwrite field values" box - on my search head. Now I see the right host names associated with the events. ... View more

Sorry, I should have mentioned that I already verified the "serverName = " value in $SPLUNK_HOME/etc/system/local/server.conf, and "host = " in $SPLUNK_HOME/etc/system/local/inputs.conf. They are both set to the same value returned by the "hostname" command on the system. I also verified that "$SPLUNK_HOME/bin/splunk cmd btool [server|inputs] list --debug" shows the correct serverName and host values; but neither one of those shows an "instance(Name) = " value. ... View more