Getting Data In

Why are 2800 Universal Forwarders showing missing status in CMC - Forwarders Deployment



A customer I am dealing with has a hybrid setup (UF, HF, DS on-prem) and the Rest of Infra in Splunk Cloud. There are  2800+ Universal Forwarders in  a missing status. These were operational, however filtering was not setup correctly, so they blew the 150GB limit on Splunk Cloud. They decided to run an SCCM deployment to delete to the CONF files in UF configuration. Now, a re-install on the agent and trying to apply HF Config is not changing these statuses. Would a rebuild forwarder assets period set to 24 delete all HF with missing status and will these be discovered again?

Or - Do we need to do a completed uninstall of UF package in SCCM, then re-deploy 9.0.2 with CONF files.




Labels (1)
0 Karma


Hi @Stu74,

let me understand:

  • are the UFs in missing status really missed or it's a wrong state?
  • are youspeaking of the Monitoring Console App or of the Deployment Server?

If you're speaking of the MC and they really are out of perimeter, you have only to rebuild the perimeter lookup and you'll have a correct situation.

if you're speaking of the DS, you should analyze your perimeter listing the servers that should be active, then check the installation and delete the out of perimeter from the DS.

You don't need (only for this reason) to reinstall the UF, obviously, you have to upgrade it if you need an upgrade.



0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...