Remove UF from Splunk Enterprise

[mcfly227]

I recently had a AD machine which had a UF on it decommissioned. I have alerts setup for missing Forwarders as well. I cannot seem to find how to remove the UF from the HF and Splunk main instance. Is there documentation that I am missing? 

[mcfly227]

Giuseppe, 
Thank you this is exactly what I was looking for, the rebuild option. I was looking in the incorrect area. This resolved my issue! 

[gcusello]

Hi @mcfly227 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @mcfly227 ,

it depends on how you implemented missing clients discovery alert:

if you're using the Monitoring Console alert, you have only to rebuild the forwarder asset list in [Settings > Monitoring Console > Settings > Forwarder Monitoring setup > Rebuild forwarder asset list].

If you're using a custom search, it depends on how you are performing the check, probably using your own lookup, in this case, you have to remove the host fron this lookup.

Ciao.

Giuseppe