Universal Forwarder has not removed itself from the DMC

[Brolly75]

I have had a host go down in aws that was not recoverable a few weeks ago and the universal forwarder is still showing as missing in the "distributed management console".

Does anyone know how to force its removal?

[Jeremiah · Accepted solution]

From the DMC documentation:

To remove a forwarder entirely from the DMC dashboards, click rebuild forwarder assets in Distributed Management Console > Settings > Forwarder Setup. This one time that you run this populating search, you can choose a lookback time. This selection does not change the 15 minute lookback time for the scheduled search or the data collection interval, both discussed above.

http://docs.splunk.com/Documentation/Splunk/6.3.2/DMC/Configureforwardermonitoring