Hello,
I need to set Windows forwarders to use the FQDN as the hostname across all inputs, as I have duplicate hostnames in my environment. I've tried changing everything in a Splunk deployment app, but the only thing that seems to work is if I manually correct the entry in C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf from hostname to FQDN.
From:
[default]
host = svr-vCenter
To:
[default]
host = svr-vCenter.domain.local
The changes that I've made in the deployment app have meant that the splunkd.log reports the name correctly:
10-08-2016 16:46:59.063 +0100 INFO ServerConfig - Host name option is "fullyqualifiedname".
10-08-2016 16:46:59.063 +0100 INFO ServerConfig - My hostname is "svr-vCenter.domain.local".
But anything sent to the Splunk indexer shows up as the shortname and the FQDN gets ignored unless I change the file above.
Is there any way I can automatically set this during install or afterwards in Splunk other than manually changing the contents of the file? What am I missing as this is driving me nuts!
Thanks,
Andy
↧