Getting Data In

Removing uninstalled UF hosts

timtekk
Explorer

Hello, we are on Splunk 9.3 on prem. I am unable to remove a server from the Splunk forwarder management list, after it has been decommissioned and the Universal Forwarder is uninstalled. 

I get an error stating that the DELETE option is depreciated, but what has it been replaced with? I have a server that has not logged to Splunk in 9 days (and never will again), how do I remove it correctly? 

(screenshot attached)

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

it's very strange because in this documentation https://docs.splunk.com/Documentation/Splunk/9.3.1/Updating/Useforwardermanagementtomanageclients#Vi...(latest version), this feature is still present.

But many people in Community reported the same issu: https://community.splunk.com/t5/Deployment-Architecture/Unable-to-remove-records-from-the-Deployment...

Open a case to Splunk Support, because there's a behavior different than documentation.

Ciao.

Giuseppe

View solution in original post

0 Karma

timtekk
Explorer

Thank you @gcusello I'll get with support!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

are you speaking of removal from the Forwarders list in Deployment Server or Monitoring Console?

if Monitoring Console, you have only to rebuild the Forwarders List [Settings > Monitoring Console > Settings > Forwarder Monitoring Setip].

If from Deployment Server list, you can remove it from web interface [Settings > Forwarder Management > Clients].

Ciao.

Giuseppe

0 Karma

timtekk
Explorer

I am referring to the Deployment Server list. 

 

When I go to [Settings > Forwarder Management > Clients] and click DELETE RECORD on a client - it says this option has been deprecated. I can still click delete, but the client never goes aways.

See my attached screenshot. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

it's very strange because in this documentation https://docs.splunk.com/Documentation/Splunk/9.3.1/Updating/Useforwardermanagementtomanageclients#Vi...(latest version), this feature is still present.

But many people in Community reported the same issu: https://community.splunk.com/t5/Deployment-Architecture/Unable-to-remove-records-from-the-Deployment...

Open a case to Splunk Support, because there's a behavior different than documentation.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...