I've tried to locate an answer for this issue for the past few days with no luck. So I have decided to give it a shot here, perhaps someone ran into this issue before or at least can assist in providing assistance. Any feedback is greatly appreciated.
I am using Splunk with Dev license. Installed the forwarders on >200 Windows machines. Only about 55 are reporting back to the server. I am mainly looking in the data set > data summary > hosts to see the machines that are reporting. I am not sure why the remaining are not reporting back or showing up in the hosts list.
SplunkEnterprise Ver 7.2.6
Thank you for your time,
Try this alternative method to list your forwarders.
index=_internal group=tcpin_connections | stats latest(version) as version latest(arch) as arch latest(os) as os latest(fwdType) as fwdType by hostname
Then you have the correct number. The next step is to determine why the remaining forwarders are not connecting. You'll need to sign in to a server that is not reporting and examine the splunkd.log file.