Deployment Architecture

A single forwarder has multiple GUIDs Splunk v7

New Member

On the forwarder management, I was missing a client (which is indexing data and showing in search as well)
That same client/forwarder appears under the monitoring console forwarders.

I followed the below link and deleted instance.cfg and then restarted my forwarder.

Now I have 4 forwarders of the same host (different guids) in my monitoring console section and it is still not showing up on forwarder management section.

Any ideas on how to resolve this?

Tags (2)
0 Karma


Greetings @agarws8,

If the forwarder was not properly installed (like what would happen if a VM image was just placed on a new server), the instance.cfg file will be "wrong" (identical to a different server), and the values of the following will be wrong. Make sure they properly match the host (and then restart the forwarder)


host = [wrong host?]


serverName = [wrong host?]

Note that this could be on the server you think it is OR it could be on a different host.

If you have windows event monitoring set up, find a popular event code that displays the machine name and compare it to the host value looking for differences.



If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...