Deployment Architecture

Forwarder Management - Duplicated hosts

mikelanghorst
Motivator

Recently I looked at the Forwarder Management page, and selected the "Phone Home: Later than Expected". A large number of hosts were listed here, but when I filtered for the individual hosts, and set it back to Phone Home: All, I found that the host was listed multiple times.

Now some of them were likely related to DHCP IP's being changed. But several of them have static IP's.

The page shows that the Host Name, Client Name, IP Address, are all the same. Yet one entry shows a Phone Home of 12 hours ago, while the other shows a few seconds ago.

Why the duplicates?

Tags (1)
0 Karma

mikelanghorst
Motivator

After opening a support case, I was told this was a known bug being worked on and should be in an upcoming release. The OpenSSL bug was the only fix for 6.0.3, so I'd expect it to likely be in 6.0.4.

cedarcrestone
Explorer

I have started to see the same behavior in our environment. I wish there was a way to see the duplicate ones and have those removed either automatically or some other way.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...