Monitoring Splunk

Monitoring Console shows all SHC members with the same instance name

edwardrose
Contributor

Hello All

 

I added our ES SHC to our monitoring console and the instance(host) name is all the same for all 3 search head cluster nodes.  The instance host (servername) are all unique.  How do I resolve this issue?

thanks

ed

Labels (2)
0 Karma
1 Solution

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

View solution in original post

0 Karma

Vardhan
Contributor

Hi @edwardrose ,

You can resolve the issue by changing the host field value in the inputs.conf

Go to /opt/splunk/etc/system/local

edit the inputs.conf

[default]
host = splunk@splk-es-app-01

And restart the Splunk service and check the status by using ./splunk show default-hostname

If it works do the same thing for the remaining two hosts.

 

View solution in original post

0 Karma

edwardrose
Contributor

But why did it change?

0 Karma

Vardhan
Contributor

Hi,

Can run the below command in all the search heads and see what is the result it is showing?

./splunk show server name

./splunk show default-hostname

0 Karma

edwardrose
Contributor

@Vardhan 

Here is the output from the hosts:

splunk@splk-es-app-01:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-01
splunk@splk-es-app-01:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-01:~>

splunk@splk-es-app-02:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-02
splunk@splk-es-app-02:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-02:~>

splunk@splk-es-app-03:~> splunk show servername
Your session is invalid. Please login.
Splunk username: admin
Password:
Server name: splk-es-app-03
splunk@splk-es-app-03:~> splunk show default-hostname
Default hostname for data inputs: splk-es-app-03.
splunk@splk-es-app-03:~>

 

It appears that all of them have the same default-hostname.

 

thanks

ed

 

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!