Forwarders list in monitoring console

[riqbal47010]

| inputlookup dmc_forwarder_assets | search hostname="abc-t1"

above lookup showing me duplicate hostname. we upgrade the universal forwarders from 7.1.2 to 7.3.1. now it is showing two entries. one with old connector version and 2nd with newer version. from newer version it is showing that system is receiving events from this source. interestingly both records have different guid. attaching snapshot for you better understanding.

my question is that how can

1 - update the dmc_forwarder_assets manually but exludeing null values
2- OR there is some way from workstation side to fix this issue.

[woodcock]

The only reason that I can see for multiple GUIDs is either that the UF was removed and then reinstalled (as opposed to simply upgraded) or that you have multiple UFs installed on the same server. There are several good reasons why you might install multiple UFs. One is if you are forwarding compressed files. The Archive Processor (AKA AQ and AEQ) is single-threaded and so throughput suffers greatly when forwarding these.

[rvaglid]

Hi there, how did you upgrade the UFs? If you remove the whole /opt/splunkforwarder and then installed 7.3.1.1, a new guid would have been generated.

The GUID (since 5.x) gets stored in
$SPLUNK_HOME/etc/instance.cfg, ref.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Instancecfgconf

Cheers,
Rolf