Universal Forwarder has not removed itself from the DMC

Brolly75 — Sat, 09 Apr 2016 11:50:05 GMT

I have had a host go down in aws that was not recoverable a few weeks ago and the universal forwarder is still showing as missing in the "distributed management console".

Does anyone know how to force its removal?

Re: Universal Forwarder has not removed itself from the DMC

Jeremiah — Sat, 09 Apr 2016 18:08:30 GMT

From the DMC documentation:

To remove a forwarder entirely from the DMC dashboards, click rebuild forwarder assets in Distributed Management Console > Settings > Forwarder Setup. This one time that you run this populating search, you can choose a lookback time. This selection does not change the 15 minute lookback time for the scheduled search or the data collection interval, both discussed above.

http://docs.splunk.com/Documentation/Splunk/6.3.2/DMC/Configureforwardermonitoring

topic Re: Universal Forwarder has not removed itself from the DMC in Getting Data In

Universal Forwarder has not removed itself from the DMC

Re: Universal Forwarder has not removed itself from the DMC