How to remove duplicate entries from Forwarder Deployments Monitoring Dashboard ?

[hemantw7]

In Splunk monitoring console  Forwarders: Deployment panel has duplicate entries one is active with latest version and other old version as missing.

How i can remove old dated missing entries form host without building the forwarder asset table. 

Suggestions please?

sample :

[gcusello]

Hi @hemantw7,

as @richgalloway and @isoutamo said, you could manually update the lookup but I'd avoid this.

Why don't you want to rebuild the forwarders asset table?

this feature is done just for solve your problem and to eliminate dismissed forwarders.

Ciao.

Giuseppe

[richgalloway]

You should be able to use the Lookup Editor app to modify the dmc_forwarder_assets.csv file.  Do so at your own risk.

[isoutamo]

Have you done updates by removing old version and then install new one instead of updating that? This leads to generate a new GUID for that node which leads a duplicate entries with same node names. This coul also generate duplicate log events if/when you have lost the fishbucket db on UF.