https://community.splunk.com/t5/Monitoring-Splunk/How-does-Cluster-Manager-populate-dmc-forwarder-assets-input/m-p/696710#M10331 <P>The forwarder asset table is generated from tcpin_connections metrics in _internal.&nbsp; FTR, this is done by the Monitoring Console (MC), not the Cluster Manager (CM).&nbsp; The CM and MC can be co-located in limited conditions - see <A href="https://docs.splunk.com/Documentation/Splunk/9.3.0/Indexer/Systemrequirements#Additional_roles_for_the_manager_node" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.0/Indexer/Systemrequirements#Additional_roles_for_the_manager_node</A>.</P><P>Seeing the same forwarder many times often happens when a host is cloned without first preparing the forwarder for cloning.&nbsp; See the CLONEPREP installer option at <A href="https://docs.splunk.com/Documentation/Forwarder/9.3.0/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller" target="_blank">https://docs.splunk.com/Documentation/Forwarder/9.3.0/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller</A>.</P><P>The fix is to delete the GUID on each server (using the <FONT face="courier new,courier">splunk clone-prep-clear-config</FONT> command) and then restart Splunk so it generates a new GUID.&nbsp; Then have the Monitoring Console generate a new forwarder assets table.</P> Mon, 19 Aug 2024 12:16:49 GMT richgalloway 2024-08-19T12:16:49Z https://community.splunk.com/t5/Monitoring-Splunk/How-does-Cluster-Manager-populate-dmc-forwarder-assets-input/m-p/696445#M10326 <P>Does anyone know how does Cluster Manager populate dmc_forwarder_assets input lookup csv table?</P><P>I have an issue where my UF forwarder reports show hosts with os containing repeated entries of Windows hundreds and even 000's of times.</P><P>I'd like to check how this data table is being populated by CM?</P> Fri, 16 Aug 2024 03:16:23 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-does-Cluster-Manager-populate-dmc-forwarder-assets-input/m-p/696445#M10326 slider8p2023 2024-08-16T03:16:23Z https://community.splunk.com/t5/Monitoring-Splunk/How-does-Cluster-Manager-populate-dmc-forwarder-assets-input/m-p/696710#M10331 <P>The forwarder asset table is generated from tcpin_connections metrics in _internal.&nbsp; FTR, this is done by the Monitoring Console (MC), not the Cluster Manager (CM).&nbsp; The CM and MC can be co-located in limited conditions - see <A href="https://docs.splunk.com/Documentation/Splunk/9.3.0/Indexer/Systemrequirements#Additional_roles_for_the_manager_node" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.0/Indexer/Systemrequirements#Additional_roles_for_the_manager_node</A>.</P><P>Seeing the same forwarder many times often happens when a host is cloned without first preparing the forwarder for cloning.&nbsp; See the CLONEPREP installer option at <A href="https://docs.splunk.com/Documentation/Forwarder/9.3.0/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller" target="_blank">https://docs.splunk.com/Documentation/Forwarder/9.3.0/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller</A>.</P><P>The fix is to delete the GUID on each server (using the <FONT face="courier new,courier">splunk clone-prep-clear-config</FONT> command) and then restart Splunk so it generates a new GUID.&nbsp; Then have the Monitoring Console generate a new forwarder assets table.</P> Mon, 19 Aug 2024 12:16:49 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-does-Cluster-Manager-populate-dmc-forwarder-assets-input/m-p/696710#M10331 richgalloway 2024-08-19T12:16:49Z