Getting Data In

How to remove "missing" forwarders from the Distributed Management Console?

coltwanger
Contributor

When a server is decommissioned in our environment, it's brought offline, severing the communication with Splunk. The Distributed Management Console, however, reports these forwarders as "missing" and doesn't appear to let up, or clear then from any queue.

I would love to use this feature to accurately identify a forwarder that has stopped sending data for some reason. Is there a way to "remove" the forwarder that's labeled as "missing" when I know that the server has been brought offline? I have something like 250 devices listed as "missing" with no obvious way to clear them.

0 Karma
1 Solution

hexx
Splunk Employee
Splunk Employee

You'll have to regenerate the forwarder asset table with in the setup > forwarder monitoring page - see this documentation page for details.

View solution in original post

hexx
Splunk Employee
Splunk Employee

You'll have to regenerate the forwarder asset table with in the setup > forwarder monitoring page - see this documentation page for details.

lakromani
Builder

This does work, but there should be a way to delete on host instead of removing all en regenerate the list. If you have 1000 servere, then there will be some that would be down for maintenance and they go back online. And there will be server that should be removed permanently. If I then do the regenerate, I remove all server that is not online, not just the one I like to remove.

coltwanger
Contributor

This helps -- thank you!

0 Karma