How to remove "missing" forwarders from the Distributed Management Console?

[coltwanger]

When a server is decommissioned in our environment, it's brought offline, severing the communication with Splunk. The Distributed Management Console, however, reports these forwarders as "missing" and doesn't appear to let up, or clear then from any queue.

I would love to use this feature to accurately identify a forwarder that has stopped sending data for some reason. Is there a way to "remove" the forwarder that's labeled as "missing" when I know that the server has been brought offline? I have something like 250 devices listed as "missing" with no obvious way to clear them.

[hexx · Accepted solution]

You'll have to regenerate the forwarder asset table with in the setup > forwarder monitoring page - see this documentation page for details.

[lakromani]

This does work, but there should be a way to delete on host instead of removing all en regenerate the list. If you have 1000 servere, then there will be some that would be down for maintenance and they go back online. And there will be server that should be removed permanently. If I then do the regenerate, I remove all server that is not online, not just the one I like to remove.

[coltwanger]

This helps -- thank you!