topic Re: Missing forwarders management in Deployment Architecture

Missing forwarders management

splunkreal — Mon, 26 Jul 2021 16:59:55 GMT

Hello guys,

how do you handle missing forwarders (deleted VMs for instance)?

Do you go to "Forwarder management" then "Delete record" or you "rebuild forwarder assets" in DMC (this last one seems enough)?

Thanks.

Re: Missing forwarders management

codebuilder — Mon, 26 Jul 2021 17:52:33 GMT

To remove a missing forwarder use the "rebuild forwarder assets" as you mentioned.

DMC > Settings > Forwarder Monitoring Setup > Rebuild forwarder assets

This will allow you to select a time range for which to exclude forwarders that have not checked in.

Re: Missing forwarders management

splunkreal — Mon, 26 Jul 2021 18:21:32 GMT

What about "Forwarder management" then "Delete record"?

Does rebuilding assets table clears missing forwarders in forwarder management (I wait 1h but still seeing old servers...)? If I remember but not sure, it worked in V6.

Thanks.

Re: Missing forwarders management

codebuilder — Mon, 26 Jul 2021 19:46:10 GMT

Yes, it clears them but you have to select a time range that excludes them from being found in search.

Re: Missing forwarders management

codebuilder — Mon, 26 Jul 2021 19:50:20 GMT

Also, your last link refers to the deployment server, not the DMC.

Re: Missing forwarders management

splunkreal — Mon, 26 Jul 2021 21:35:30 GMT

OK I understand we must rebuild list in DMC and remove forwarders from deployment server (may be quicker to reload it), thanks 🙂