How to resolve DMC missing forwarders alert reporting instances already reporting properly

New Member

I am constantly receiving the DMC missing forwarders alert advising that 50 UFs are not reporting in. I have checked and they are reporting in.

In an attempt to fix this I have run the 'rebuild forwarder assets' command, but the alerts are still coming out

one thing I have noticed is that the version column in the report produced is not showing the correct installed version (7.2.6 has recently been installed, however, the report shows 7.2.1)

Any ideas welcome, please show me to how to resolve this, I'm thinking currently that restarting Splunk on the UFs and then attempting 'rebuild forwarder assets' perhaps?

0 Karma

New Member

well restarting splunk on UFs didn't fix the problem - any thoughts?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!