Getting Data In

Removing uninstalled UF hosts

timtekk
Explorer

Hello, we are on Splunk 9.3 on prem. I am unable to remove a server from the Splunk forwarder management list, after it has been decommissioned and the Universal Forwarder is uninstalled. 

I get an error stating that the DELETE option is depreciated, but what has it been replaced with? I have a server that has not logged to Splunk in 9 days (and never will again), how do I remove it correctly? 

(screenshot attached)

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

it's very strange because in this documentation https://docs.splunk.com/Documentation/Splunk/9.3.1/Updating/Useforwardermanagementtomanageclients#Vi...(latest version), this feature is still present.

But many people in Community reported the same issu: https://community.splunk.com/t5/Deployment-Architecture/Unable-to-remove-records-from-the-Deployment...

Open a case to Splunk Support, because there's a behavior different than documentation.

Ciao.

Giuseppe

View solution in original post

0 Karma

timtekk
Explorer

Thank you @gcusello I'll get with support!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

are you speaking of removal from the Forwarders list in Deployment Server or Monitoring Console?

if Monitoring Console, you have only to rebuild the Forwarders List [Settings > Monitoring Console > Settings > Forwarder Monitoring Setip].

If from Deployment Server list, you can remove it from web interface [Settings > Forwarder Management > Clients].

Ciao.

Giuseppe

0 Karma

timtekk
Explorer

I am referring to the Deployment Server list. 

 

When I go to [Settings > Forwarder Management > Clients] and click DELETE RECORD on a client - it says this option has been deprecated. I can still click delete, but the client never goes aways.

See my attached screenshot. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timtekk ,

it's very strange because in this documentation https://docs.splunk.com/Documentation/Splunk/9.3.1/Updating/Useforwardermanagementtomanageclients#Vi...(latest version), this feature is still present.

But many people in Community reported the same issu: https://community.splunk.com/t5/Deployment-Architecture/Unable-to-remove-records-from-the-Deployment...

Open a case to Splunk Support, because there's a behavior different than documentation.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...