Set default host for a Splunk server
This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.0 , 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4
Contents
Set default host for a Splunk server
The host value of an event is the hostname or IP address of the network host which originated the event. When Splunk is running on the server where the event occurred the assignment of host is straight forward. The default name is the host of the Splunk server.
via SplunkWeb
You can change the default host value via SplunkWeb. Click on the Admin button in the upper right hand corner. You can change the Default host value under the Datastore section:
via configuration files
This host assignment is written in inputs.conf during installation. You can modify the host entry by editing $SPLUNK_HOME/etc/bundles/local/inputs.conf.
This is the format of the host assignment in inputs.conf:
host = <string>
* This is a shortcut for MetaData:Host = <string>. It sets the host of
events from this input to be the specified string. "host::" is
automatically prepended to the value when this shortcut is used.
Set your own host value by changing the entry for <string>.