Why are 2800 Universal Forwarders showing missing status in CMC - Forwarders Deployment

[Stu74]

Hi,

A customer I am dealing with has a hybrid setup (UF, HF, DS on-prem) and the Rest of Infra in Splunk Cloud. There are  2800+ Universal Forwarders in  a missing status. These were operational, however filtering was not setup correctly, so they blew the 150GB limit on Splunk Cloud. They decided to run an SCCM deployment to delete to the CONF files in UF configuration. Now, a re-install on the agent and trying to apply HF Config is not changing these statuses. Would a rebuild forwarder assets period set to 24 delete all HF with missing status and will these be discovered again? 

https://community.splunk.com/t5/Getting-Data-In/How-far-back-can-be-go-when-rebuilding-the-forwarder...

Or - Do we need to do a completed uninstall of UF package in SCCM, then re-deploy 9.0.2 with CONF files.

Thanks,

Stuart

[gcusello]

Hi @Stu74,

let me understand:

• are the UFs in missing status really missed or it's a wrong state?
• are youspeaking of the Monitoring Console App or of the Deployment Server?

If you're speaking of the MC and they really are out of perimeter, you have only to rebuild the perimeter lookup and you'll have a correct situation.

if you're speaking of the DS, you should analyze your perimeter listing the servers that should be active, then check the installation and delete the out of perimeter from the DS.

You don't need (only for this reason) to reinstall the UF, obviously, you have to upgrade it if you need an upgrade.

Ciao.

Giuseppe