All Apps and Add-ons

How do I remove list of Decommissioned hots from the List of "Missing Forwarders" I get from Splunk Monitoring console?

SamHTexas
Builder

How do I remove list of Decommissioned hots from the List of "Missing Forwarders" I get from Splunk Monitoring console? I get a list of Missing FWs located on hosts that are decommissioned on weekly basis. How do I clean it the list so I won't get repeated lists about the decommissioned boxes please? Thank u in advance.

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SamHTexas,

you have to rebuild the Monitored Forwarders list in [Settings -- Monitoring Console -- Settings -- Forwarder Monitoring Setup - Rebuild Forwarder Assets].

The Monitgoring Consule rebuiuld the list takeing the forwarders that sent logs in the last 24 hours, this parameter is configurable.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...