search

splunk / eventgen

Splunk Event Generator: Eventgen
Apache License 2.0
376 stars 180 forks source link

[BUG] leave the httpevent outputServers as it is #356

Closed YifengMao closed 4 years ago

YifengMao commented 4 years ago

Describe the bug hostname will be automatically converted to ip addr in setup() api: ` self.discovered_servers = [] for host in hosts: try: formatted_hostname = socket.gethostbyname(host) if new_key: key = create_new_hec_key(formatted_hostname) except (socket.gaierror, requests.ConnectionError): self.logger.warning('failed to reach %s, skip...' % host) continue except (ValueError, KeyError): self.logger.warning('failed to setup hec token for %s, skip...' % host) continue

            self.discovered_servers.append({"protocol": str(protocol), "address": str(formatted_hostname), "port": str(hec_port), "key": str(key)})

` if i have a dynamic provisioned splunk behind a fixed FQDN, i don't have any workarounds to make it work. Is it possible to leave the host as it is in setup stage?

jcmia1 commented 4 years ago

I am seeing issues reported in this forum discussions: https://forums.aws.amazon.com/message.jspa?messageID=714343. This means in-flight events could be sending to a wrong destination IF the IPs change. I have already experienced this in our labs.