Monitoring Splunk

Monitoring Console shows all SHC members with the same instance name

edwardrose
Contributor

Hello All

 

I added our ES SHC to our monitoring console and the instance(host) name is all the same for all 3 search head cluster nodes.  The instance host (servername) are all unique.  How do I resolve this issue?

thanks

ed

Labels (2)
0 Karma
1 Solution

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

View solution in original post

0 Karma

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

0 Karma

edwardrose
Contributor

But why did it change?

0 Karma

Vardhan
Contributor

Hi,

Can run the below command in all the search heads and see what is the result it is showing?

./splunk show server name

./splunk show default-hostname

0 Karma

edwardrose
Contributor

@Vardhan 

Here is the output from the hosts:

splunk@splk-es-app-01:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-01
splunk@splk-es-app-01:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-01:~>

splunk@splk-es-app-02:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-02
splunk@splk-es-app-02:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-02:~>

splunk@splk-es-app-03:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-03
splunk@splk-es-app-03:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-03:~>

 

It appears that all of them have the same default-hostname.

 

thanks

ed

 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...