topic Re: Forwarder Management shows 0 agents in Getting Data In

Forwarder Management shows 0 agents

zksvc — Thu, 16 Oct 2025 08:33:52 GMT

Hi all,

Yesterday I had 8 Universal Forwarders visible in Forwarder Management. Today it shows 0.

Environment

Splunk Enterprise on Linux acting as a Deployment Server
Mix of Linux and Windows Universal Forwarders
Forwarder Management UI has no filters; “All versions” is selected

Questions

What are the first checks you recommend when the agent list suddenly drops to zero?
Could this be related to license state, SSL on port 8089, or server classes?
How can I quickly confirm whether forwarders are still phone-homing to the DS?
Which logs or REST endpoints should I look at on the DS and on a UF?
Any common misconfigurations that cause this overnight?

Thanks for any guidance and a simple step-by-step to diagnose.

Re: Forwarder Management shows 0 agents

elend — Thu, 16 Oct 2025 08:38:27 GMT

Did you use a custom apps for manage the clients?
i have same simmilar case with this. If there another config file (in my case, there is a restmap config with [broker:broker] stanza).

After i remove this file, and restart the service the deployment server show all the forwarders.

Re: Forwarder Management shows 0 agents

zksvc — Thu, 16 Oct 2025 08:52:27 GMT

Hey @elend

Thankyou for your reply, yes i have restmap.conf too in my custom apps. i got it from template custom apps from my friends, after i comment it all is going good.

Thanks for help 🤍
Danke

Zake