Troubleshoot multiple systems reporting the same hostname

All cloned systems appear under the same hostname in the Splunk environment.

  1. Manually set the hostname by taking these substeps:
    1. Create or overwrite the inputs.conf file, if it already exists, in the local directory of the universal forwarder, and add the [default] stanza to it:
      CODE 
      echo "[default]" > /opt/splunkforwarder/etc/system/local/inputs.conf
    2. In the inputs.conf file, set a value of the host setting to the actual hostname of the machine where you execute the command:
      CODE 
      echo "host = $(hostname)" >> /opt/splunkforwarder/etc/system/local/inputs.conf
  2. Restart the universal forwarder:
    CODE 
    /opt/splunkforwarder/bin/splunk restart