topic Re: Removing uninstalled UF hosts in Getting Data In

Removing uninstalled UF hosts

timtekk — Wed, 09 Oct 2024 20:34:48 GMT

Hello, we are on Splunk 9.3 on prem. I am unable to remove a server from the Splunk forwarder management list, after it has been decommissioned and the Universal Forwarder is uninstalled.

I get an error stating that the DELETE option is depreciated, but what has it been replaced with? I have a server that has not logged to Splunk in 9 days (and never will again), how do I remove it correctly?

(screenshot attached)

Re: Removing uninstalled UF hosts

gcusello — Thu, 10 Oct 2024 08:30:30 GMT

Hi @timtekk ,

are you speaking of removal from the Forwarders list in Deployment Server or Monitoring Console?

if Monitoring Console, you have only to rebuild the Forwarders List [Settings > Monitoring Console > Settings > Forwarder Monitoring Setip].

If from Deployment Server list, you can remove it from web interface [Settings > Forwarder Management > Clients].

Ciao.

Giuseppe

Re: Removing uninstalled UF hosts

timtekk — Thu, 10 Oct 2024 14:59:09 GMT

I am referring to the Deployment Server list.

When I go to [Settings > Forwarder Management > Clients] and click DELETE RECORD on a client - it says this option has been deprecated. I can still click delete, but the client never goes aways.

See my attached screenshot.