I have had a host go down in aws that was not recoverable a few weeks ago and the universal forwarder is still showing as missing in the "distributed management console".
Does anyone know how to force its removal?
From the DMC documentation:
To remove a forwarder entirely from the DMC dashboards, click rebuild forwarder assets in Distributed Management Console > Settings > Forwarder Setup. This one time that you run this populating search, you can choose a lookback time. This selection does not change the 15 minute lookback time for the scheduled search or the data collection interval, both discussed above.
http://docs.splunk.com/Documentation/Splunk/6.3.2/DMC/Configureforwardermonitoring
From the DMC documentation:
To remove a forwarder entirely from the DMC dashboards, click rebuild forwarder assets in Distributed Management Console > Settings > Forwarder Setup. This one time that you run this populating search, you can choose a lookback time. This selection does not change the 15 minute lookback time for the scheduled search or the data collection interval, both discussed above.
http://docs.splunk.com/Documentation/Splunk/6.3.2/DMC/Configureforwardermonitoring