https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Stream-Distributed-Forwarder-Management/m-p/388812#M47451 <P>Have you tried removing the infra_dns from the stream_forwarder_id stanza in the inputs.conf?<BR /> Then restart the client instance. Go to the Distributed group you made in the Stream app and see if it appears in your available client regex area?</P> Wed, 30 Sep 2020 00:37:32 GMT markhill1 2020-09-30T00:37:32Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Stream-Distributed-Forwarder-Management/m-p/388811#M47450 <P>I am successfully collecting DNS logs from some domain controllers, but I noticed the Distributed Forwarder Management isn't working how I intended. All of my clients are falling under the 'defaultgroup'. I have a group called 'infra_dns' configured with a regex rule of 'infra_dns'</P> <P>My inputs.conf on my domain controllers looks like this:</P> <P>[streamfwd://streamfwd]<BR /> splunk_stream_app_location = <A href="https://splunkserver:8000/en-us/custom/splunk_app_stream/" target="_blank">https://splunkserver:8000/en-us/custom/splunk_app_stream/</A><BR /> stream_forwarder_id = infra_dns<BR /> disabled = 0</P> <P>Any ideas?</P> Tue, 29 Sep 2020 23:17:04 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Stream-Distributed-Forwarder-Management/m-p/388811#M47450 Kendo213 2020-09-29T23:17:04Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Stream-Distributed-Forwarder-Management/m-p/388812#M47451 <P>Have you tried removing the infra_dns from the stream_forwarder_id stanza in the inputs.conf?<BR /> Then restart the client instance. Go to the Distributed group you made in the Stream app and see if it appears in your available client regex area?</P> Wed, 30 Sep 2020 00:37:32 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Stream-Distributed-Forwarder-Management/m-p/388812#M47451 markhill1 2020-09-30T00:37:32Z