Higher Host Counts in Subscription Usage Due to Duplicate Host and Host.Name Entries in Hourly Usage Detail Reports

Applicability

Description

When reviewing host counts under Settings > Subscription Usage > Infrastructure Monitoring, the reported host count appears higher than the actual number of nodes deployed in the cluster.

When downloading the Hourly Usage Detail Report, multiple entries appear for the same node: one entry associated with the host dimension and another associated with the host.name dimension. Because Splunk Observability Cloud evaluates host and host.name as separate resource identifiers, each node is counted twice in usage and billing metrics.

Investigation

Follow these steps to confirm if duplicate host attributes are causing inflated host counts:

1. Download and review the usage report:
   
   

   • Navigate to Settings > Subscription Usage > Infrastructure Monitoring.

   • Click the Download icon in the top-right corner to download the Hourly Usage Detail Report.

   • Inspect the report rows to check whether the same hostname or IP appears under both host and host.name attributes.
     
     

2. Inspect the OpenTelemetry Collector ConfigMap:
   
   Run the following command to retrieve the collector pipeline configuration in the Kubernetes namespace:
   
   

   kubectl get configmap splunk-otel-collector-otel-agent -n <namespace> -o yaml

3. Check the processors and exporters in the pipeline configuration:
   
   

   • In relay.yaml, verify whether the resourcedetection processor is active and populating host.name.

   • Check whether the signalfx exporter or other upstream components are attaching the host dimension.

   • If host.name is not mapped to host and subsequently removed, both attributes are forwarded to the ingest endpoint, resulting in duplicate host registration.

Resolution

Update the Splunk OpenTelemetry Collector configuration to map host.name into host and remove the duplicate host.name attribute.

1. Update the Resource Processor Configuration

In the collector configuration (relay.yaml or Helm values.yaml), locate the resource processor and add attribute actions to upsert host.name into host and delete host.name:

processors:
  resource:
    attributes:
      - action: upsert
        from_attribute: host.name
        key: host
      - action: delete
        key: host.name

2. Verify Pipeline Configuration

Ensure that the resource processor is positioned after resourcedetection in the relevant metrics pipelines under the service section:

service:
  pipelines:
    metrics:
      receivers: [hostmetrics, kubeletstats, otlp]
      processors: [memory_limiter, batch, resourcedetection, resource]
      exporters: [signalfx]

3. Apply Configuration and Restart Collector Pods

Apply the updated Helm values or Kubernetes ConfigMap and perform a rollout restart of the collector daemonset:

4. Verify Usage Metrics

Allow 1–2 reporting intervals for updated metrics to register. Review Settings > Subscription Usage > Infrastructure Monitoring and download a new Hourly Usage Detail Report to confirm that host identities are unified under the single host dimension and duplicate counts are eliminated.