Where does windows get its host field from?

Question

I have a few windows machines Light Forwarding in to a central indexer, sending just WinEventLogs for now. For most hosts, its events' ComputerName is the same as the host field. For a couple, it's not.

It's causing confusion as server A, which shows up at ComputerName A in its events, comes through with a host field of B, the name of a different existing server not currently running a Splunk forwarder.

Where does Splunk on Windows get its host: field from, and can it be explicitly be overridden?

Answer 1

1

The Host field in events coming from Windows Event Logs is set by the value in "ComputerName" field. To overwrite this, set the value of the Host field in etc\apps\windows\local\inputs.conf You can set it globally under the [default] stanza, or you can set it individually for each Event Log channel:

[WinEventLog:Application]
host = host.ad.com
...

link

answered 14 Jul '10, 21:04

Ledio Ago ♦
679●3●6●15
accept rate: 33%

edited 14 Jul '10, 21:38

the_wolverine ♦
5.2k●17●20●85

1

A Splunk server (including a forwarder) will always have the default "host" value set in $SPLUNK_HOME\etc\system\local\inputs.conf by first-time run. The value is set to the result of the hostname command run on the machine at that time. This can be changed or overridden in another inputs.conf globally or by stanza, but unless this is done, WinEventLogs will end up using this value.

(14 Jul '10, 22:04) gkanapathy ♦

If logs are collected via WMI (not likely in the case of LWF), the host will be set to the value of the ComputerName field.

(14 Jul '10, 22:04) gkanapathy ♦

Answer 2

I've been affected by and tracking this issue for more than a year. There doesn't seem to be any good answer (this isn't one either I'm afraid), and windows hosts seem to return an essentially random host value based on the computer name somehow :-).
Can we please have a proper solution to this in the windows app, which allows the user at setup-time to require ALL events to be indexed with either FQDN or computer name, or at any rate ONE VALUE PER COMPUTER. I've seen 'solutions' which range from hard-coding the name in inputs.conf (which isn't available with WMI anyway), messing around with props and transforms, to rewriting the data at index time. In my experience, Splunk admins can't control how a given windows box has been setup, so we must have a way to work around this reliably and consistently. Many shops, and nearly all the larger ones, are multiplatform, and it's high time that the windows and unix apps behaved the same way. Even in an all-windows site, you will see interesting variations on the hostname, which make searches and UI elements needlessly painful to construct.

Where does windows get its host field from?

Follow this question

Splunk Resources

Related questions