topic Re: Remove UF from Splunk Enterprise in Getting Data In

Remove UF from Splunk Enterprise

mcfly227 — Tue, 10 Jun 2025 13:06:32 GMT

I recently had a AD machine which had a UF on it decommissioned. I have alerts setup for missing Forwarders as well. I cannot seem to find how to remove the UF from the HF and Splunk main instance. Is there documentation that I am missing?

Re: Remove UF from Splunk Enterprise

gcusello — Tue, 10 Jun 2025 13:18:33 GMT

Hi @mcfly227 ,

it depends on how you implemented missing clients discovery alert:

if you're using the Monitoring Console alert, you have only to rebuild the forwarder asset list in [Settings > Monitoring Console > Settings > Forwarder Monitoring setup > Rebuild forwarder asset list].

If you're using a custom search, it depends on how you are performing the check, probably using your own lookup, in this case, you have to remove the host fron this lookup.

Ciao.

Giuseppe

Re: Remove UF from Splunk Enterprise

mcfly227 — Tue, 10 Jun 2025 13:22:06 GMT

Giuseppe,
Thank you this is exactly what I was looking for, the rebuild option. I was looking in the incorrect area. This resolved my issue!

Re: Remove UF from Splunk Enterprise

gcusello — Tue, 10 Jun 2025 13:23:09 GMT

Hi @mcfly227 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉