How do I remove list of Decommissioned hots from the List of "Missing Forwarders" I get from Splunk Monitoring console? I get a list of Missing FWs located on hosts that are decommissioned on weekly basis. How do I clean it the list so I won't get repeated lists about the decommissioned boxes please? Thank u in advance.
Hi @SamHTexas,
you have to rebuild the Monitored Forwarders list in [Settings -- Monitoring Console -- Settings -- Forwarder Monitoring Setup - Rebuild Forwarder Assets].
The Monitgoring Consule rebuiuld the list takeing the forwarders that sent logs in the last 24 hours, this parameter is configurable.
Ciao.
Giuseppe