I have about 6 hosts that are reporting their IP address to my deployment server incorrectly.
They are running Universal Forwarder 6.5.2.
![alt text][1]
They all show up as the same 172.22.254.250 address.
[1]: /storage/temp/194222-capture.png
I have checked the local /etc/hosts on the forwarder systems themselves. I have checked ifconfig on those hosts to confirm that they don't have some weird binding. I checked the deployment server /etc/hosts and can ping them all correctly by their actual 10.214.3.X IP address. I also checked the /SPLUNKHOME/etc/system/local/server.conf file. Nada.
Any ideas?
↧