A single forwarder has multiple GUIDs Splunk v7

[agarws8]

On the forwarder management, I was missing a client (which is indexing data and showing in search as well)
That same client/forwarder appears under the monitoring console forwarders.

I followed the below link and deleted instance.cfg and then restarted my forwarder.
https://answers.splunk.com/answers/694188/why-is-our-universal-forwarder-not-visible-in-the.html

Now I have 4 forwarders of the same host (different guids) in my monitoring console section and it is still not showing up on forwarder management section.

Any ideas on how to resolve this?

[jacobpevans]

Greetings @agarws8,

If the forwarder was not properly installed (like what would happen if a VM image was just placed on a new server), the instance.cfg file will be "wrong" (identical to a different server), and the values of the following will be wrong. Make sure they properly match the host (and then restart the forwarder)

$SPLUNK_HOME\etc\system\local\inputs.conf

[default]
host = [wrong host?]

$SPLUNK_HOME\etc\system\local\server.conf

[general]
serverName = [wrong host?]

Note that this could be on the server you think it is OR it could be on a different host.

If you have windows event monitoring set up, find a popular event code that displays the machine name and compare it to the host value looking for differences.

Cheers,
Jacob