topic Re: Unanswered question about duplicate forwarders after upgrading in Splunk Enterprise

Unanswered question about duplicate forwarders after upgrading

tylermonteith — Wed, 21 Aug 2024 10:27:49 GMT

Here is an old post from 2019 that was unanswered.

https://community.splunk.com/t5/Deployment-Architecture/Remove-missing-duplicate-forwarders-from-forwarder-managment/m-p/492211

I am running into the same issue. Splunk Enterprise 9.2.2. Basically we had maybe 400+ machines with version 9.0.10. When upgrading to a newer splunkforwarder 9.2.2 under Forwarder Management there is duplicate instances of the computers. Pushing our Clients now to above 800. How can you remove the duplicates with going through each duplicate and clicking delete Record?

Thanks

Re: Unanswered question about duplicate forwarders after upgrading

PaulPanther — Wed, 21 Aug 2024 10:42:30 GMT

You have two options:

1. Rebuild the Forwarder Asset table in the DMC

2. Create a custom search to identify duplicate hostnames and remove these entries of missing forwarder in the lookup file dmc_fowarder_assets.csv that is located in the splunk_monitoring_console app

Re: Unanswered question about duplicate forwarders after upgrading

tylermonteith — Wed, 21 Aug 2024 12:06:06 GMT

But can you give me a bit more on the Rebuild Forwarder Asset table in the DMC? And do you have maybe how that search would look? I have basically generally searched for specific users in the search and reporting field. So any more pointing in the direction would help. But in the interim, I will start looking into this as a solution and work towards it. Appreciate it

Re: Unanswered question about duplicate forwarders after upgrading

PaulPanther — Wed, 21 Aug 2024 14:16:59 GMT

|inputlookup dmc_forwarder_assets.csv
| sort - last_connected hostname
|streamstats count by hostname
|search status=active OR (status=missing AND count=1)
|fields - count
| outputlookup dmc_forwarder_assets.csv