topic How to remove duplicate entries from Forwarder Deployments Monitoring Dashboard ? in Installation

How to remove duplicate entries from Forwarder Deployments Monitoring Dashboard ?

hemantw7 — Fri, 03 Feb 2023 18:55:32 GMT

In Splunk monitoring console Forwarders: Deployment panel has duplicate entries one is active with latest version and other old version as missing.

How i can remove old dated missing entries form host without building the forwarder asset table.

Suggestions please?

sample :

Re: How to remove duplicate entries from Forwarder Deployments Monitoring Dashboard ?

richgalloway — Fri, 03 Feb 2023 19:11:41 GMT

You should be able to use the Lookup Editor app to modify the dmc_forwarder_assets.csv file. Do so at your own risk.

Re: How to remove duplicate entries from Forwarder Deployments Monitoring Dashboard ?

isoutamo — Fri, 03 Feb 2023 19:28:26 GMT

Have you done updates by removing old version and then install new one instead of updating that? This leads to generate a new GUID for that node which leads a duplicate entries with same node names. This coul also generate duplicate log events if/when you have lost the fishbucket db on UF.

Re: How to remove duplicate entries from Forwarder Deployments Monitoring Dashboard ?

gcusello — Sat, 04 Feb 2023 07:08:33 GMT

Hi @hemantw7,

as @richgalloway and @isoutamo said, you could manually update the lookup but I'd avoid this.

Why don't you want to rebuild the forwarders asset table?

this feature is done just for solve your problem and to eliminate dismissed forwarders.

Ciao.

Giuseppe