https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254871#M48950 <P>This helps -- thank you!</P> Tue, 30 Aug 2016 22:48:51 GMT coltwanger 2016-08-30T22:48:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254869#M48948 <P>When a server is decommissioned in our environment, it's brought offline, severing the communication with Splunk. The Distributed Management Console, however, reports these forwarders as "missing" and doesn't appear to let up, or clear then from any queue. </P> <P>I would love to use this feature to accurately identify a forwarder that has stopped sending data for some reason. Is there a way to "remove" the forwarder that's labeled as "missing" when I know that the server has been brought offline? I have something like 250 devices listed as "missing" with no obvious way to clear them. </P> Tue, 30 Aug 2016 22:06:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254869#M48948 coltwanger 2016-08-30T22:06:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254870#M48949 <P>You'll have to regenerate the forwarder asset table with in the setup &gt; forwarder monitoring page - see <A href="http://docs.splunk.com/Documentation/Splunk/6.4.0/DMC/Configureforwardermonitoring#Rebuild_the_forwarder_asset_table">this documentation page</A> for details.</P> Tue, 30 Aug 2016 22:43:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254870#M48949 hexx 2016-08-30T22:43:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254871#M48950 <P>This helps -- thank you!</P> Tue, 30 Aug 2016 22:48:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254871#M48950 coltwanger 2016-08-30T22:48:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254872#M48951 <P>This does work, but there should be a way to delete on host instead of removing all en regenerate the list. If you have 1000 servere, then there will be some that would be down for maintenance and they go back online. And there will be server that should be removed permanently. If I then do the regenerate, I remove all server that is not online, not just the one I like to remove. </P> Wed, 02 Jan 2019 08:08:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-quot-missing-quot-forwarders-from-the-Distributed/m-p/254872#M48951 lakromani 2019-01-02T08:08:54Z