topic Re: UF not in CMC in Getting Data In

UF not in CMC

msatish — Thu, 08 May 2025 05:16:41 GMT

Newly installed Universal forwarders on windows servers are forwarding logs to Splunk Cloud but newly installed forwarders name is not coming up in forwarders list in Cloud Monitoring Console. What could be the reason?

Re: UF not in CMC

kiran_panchavat — Thu, 08 May 2025 06:20:45 GMT

@msatish

You need to rebuild the forwarder asset table in the CMC for it to update properly.

Go to CMC > Forwarders > Forwarder Monitoring Setup > Rebuild Forwarder Assets

Refer the below docs:

Use the Forwarder dashboards - Splunk Documentation

Solved: monitoring console triggered alerts - missing forw... - Splunk Community

Solved: Why is our universal forwarder not visible in the ... - Splunk Community

Re: UF not in CMC

livehybrid — Thu, 08 May 2025 07:58:48 GMT

Hi @msatish

It looks like you need to "Rebuild Forwarder Assets". This can be done by going to Cloud Monitoring Console > Forwarders > Forwarder Monitoring Setup. and clicking on the "Rebuild Forwarder Assets" button.

I'd also recommend checking out the Review the Forwarder Monitoring Setup page docs which has more info about this and how to view/manage your forwarders via the CMC.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: UF not in CMC

isoutamo — Fri, 16 May 2025 16:58:55 GMT

The rebuild of forwarders assets should happen automatically with period what is defined into CMC -> Forwarders -> Forwarder Monitoring Setup: Data Collection Interval.
If that time has gone after you have add this UF and you can see those logs in _internal index and this continue I propose that you create a support ticket that they could figure out why this forwarder asset hasn't updated as expected.

Of course if time has elapsed less than that period you could update it manually or decrease that time and build it again. What is preferred time period for update is depending on your needs to get those UF into this list and how many UFs you have.

Re: UF not in CMC

PickleRick — Fri, 16 May 2025 18:35:36 GMT

While rebuilding forwarder database might sometimes help if it becomes corrupted or contains too many orphaned entries, the question worth looking into is how your UFs are deployed and configured. Are you sure they aren't sharing the GUID and hostname?