Deployment Architecture

Remove missing/duplicate forwarders from forwarder managment

gregplevak
New Member

This sounds like an "asked and answered" question, but my searches didn't come up with a satisfactory answer.

How do I remove missing or duplicate forwarders from forwarder management WITHOUT rebuilding the forwarder asset table?

Here's my use case. I deploy forwarders in my laptop environment, and due to some changes to naming convention, I chose to UNINSTALL/REINSTALL the latest UF (8.0.0), resulting in devices with 2 forwarder GUIDS in the table. The old UFs (7.x.x) certainly show as missing, but I don't want to rebuild the table, because many of my laptops are in the field, and only check-in/connect every few weeks or longer. Rebuilding the forwarder asset table would delete all the machines that have vaild forwarders, but haven't checked in for awhile, leaving me with an incomplete view of my deployed environment.

What I'd like is a simple way to just delete forwarder entries that I KNOW are duplicate/stale.

thoughts? thanks!

0 Karma

PaulPanther
Motivator
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...