Dashboards & Visualizations

How do I remove hosts from the Forward and Receiving dashboard in the Distributed Management Console?

slebbie_splunk
Splunk Employee
Splunk Employee

I've disabled and removed the hosts from tcpoutput stanzas via the outputs.conf file, but the old hosts are still in the Distributed Management Console Why?

Whenever I try to remove the hosts, it says [tcpoutput://ipaddress] not found in outputs.conf. How do I remove it from the DMC completely?

*This is a question I am answering on my own because it took me a while to figure it out and I know that it may bother other folks out there so hope this helps.

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi slebbie,

Are you referring to the Forwarders: Deployment dashboard in Monitoring Console?
If you have stopped a forwarder from forwarding data to an indexer by removing the corresponding stanza from output.conf on forwarder, the forwarder will still be displayed on the dashboard but in missing (inactive) status.
You can filter out missing forwarders from some of the dashboard panels, but to completely remove the forwarder from the dashboard, you need to tamper with the metrics log and delete the related logs from source = /Applications/Splunk/var/log/splunk/metrics.log. Not sure this is what you want to do.

Hope this helps. Thanks!
Hunter

View solution in original post

putnamblake
Path Finder

If we are talking about removing the hosts which are labeled as "missing" from MC>Forwarders> Forwarders Deployment then we are able to rebuild the Forwarders Asset Table to remove decomm'd host from the dashboard/ report. 

 

https://docs.splunk.com/Documentation/Splunk/8.0.4/DMC/Configureforwardermonitoring#Rebuild_the_forw...

0 Karma

slebbie_splunk
Splunk Employee
Splunk Employee

Hi Hunters,

I totally forgot to respond to this question. Thanks for the assist.

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi slebbie,

Are you referring to the Forwarders: Deployment dashboard in Monitoring Console?
If you have stopped a forwarder from forwarding data to an indexer by removing the corresponding stanza from output.conf on forwarder, the forwarder will still be displayed on the dashboard but in missing (inactive) status.
You can filter out missing forwarders from some of the dashboard panels, but to completely remove the forwarder from the dashboard, you need to tamper with the metrics log and delete the related logs from source = /Applications/Splunk/var/log/splunk/metrics.log. Not sure this is what you want to do.

Hope this helps. Thanks!
Hunter

ppablo
Retired

Hi @slebbie_splunk

Did you forget to post your answer in the "Enter your answer here..." field below?

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...