Dashboards & Visualizations

How do I remove hosts from the Forward and Receiving dashboard in the Distributed Management Console?

slebbie_splunk
Splunk Employee
Splunk Employee

I've disabled and removed the hosts from tcpoutput stanzas via the outputs.conf file, but the old hosts are still in the Distributed Management Console Why?

Whenever I try to remove the hosts, it says [tcpoutput://ipaddress] not found in outputs.conf. How do I remove it from the DMC completely?

*This is a question I am answering on my own because it took me a while to figure it out and I know that it may bother other folks out there so hope this helps.

0 Karma
1 Solution

hunters_splunk
Splunk Employee
Splunk Employee

Hi slebbie,

Are you referring to the Forwarders: Deployment dashboard in Monitoring Console?
If you have stopped a forwarder from forwarding data to an indexer by removing the corresponding stanza from output.conf on forwarder, the forwarder will still be displayed on the dashboard but in missing (inactive) status.
You can filter out missing forwarders from some of the dashboard panels, but to completely remove the forwarder from the dashboard, you need to tamper with the metrics log and delete the related logs from source = /Applications/Splunk/var/log/splunk/metrics.log. Not sure this is what you want to do.

Hope this helps. Thanks!
Hunter

View solution in original post

putnamblake
Path Finder

If we are talking about removing the hosts which are labeled as "missing" from MC>Forwarders> Forwarders Deployment then we are able to rebuild the Forwarders Asset Table to remove decomm'd host from the dashboard/ report. 

 

https://docs.splunk.com/Documentation/Splunk/8.0.4/DMC/Configureforwardermonitoring#Rebuild_the_forw...

0 Karma

slebbie_splunk
Splunk Employee
Splunk Employee

Hi Hunters,

I totally forgot to respond to this question. Thanks for the assist.

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi slebbie,

Are you referring to the Forwarders: Deployment dashboard in Monitoring Console?
If you have stopped a forwarder from forwarding data to an indexer by removing the corresponding stanza from output.conf on forwarder, the forwarder will still be displayed on the dashboard but in missing (inactive) status.
You can filter out missing forwarders from some of the dashboard panels, but to completely remove the forwarder from the dashboard, you need to tamper with the metrics log and delete the related logs from source = /Applications/Splunk/var/log/splunk/metrics.log. Not sure this is what you want to do.

Hope this helps. Thanks!
Hunter

View solution in original post

ppablo
Community Manager
Community Manager

Hi @slebbie_splunk

Did you forget to post your answer in the "Enter your answer here..." field below?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!