Answers for "Good practice to remove serverName from server.conf?" The latest answers for the question "Good practice to remove serverName from server.conf?" Answer by xanthakita Have you considered using host=someUniqueHostname in your inputs.conf file... which you can manage from a deployment server? its possible that the _internal indexes will continue to show the servername attribute, however your regular indexed events will show from whatever name you put in inputs as host=... I often use different host names from the same UF if I am getting logs from multiple servers forwarded to one UF for example. Thu, 07 Feb 2019 19:01:38 GMT xanthakita Answer by richgalloway $COMPUTERNAME is a good default setting, but sometimes you want your forwarder to have a more descriptive name, hence the setting in etc/system/local. 1) Splunk doesn't care which setting you use so the consequences are purely in how you use your server/forwarder names. 2) Either. The trouble is you can't override etc/system/local with etc/apps/myapp/. You would have to do it with something other than the deployment server, like Puppet of Ansible. Thu, 07 Feb 2019 17:11:55 GMT richgalloway