How does Cluster Manager populate dmc_forwarder_assets input lookup csv table?

[slider8p2023]

Does anyone know how does Cluster Manager populate dmc_forwarder_assets input lookup csv table?

I have an issue where my UF forwarder reports show hosts with os containing repeated entries of Windows hundreds and even 000's of times.

I'd like to check how this data table is being populated by CM?

[richgalloway]

The forwarder asset table is generated from tcpin_connections metrics in _internal.  FTR, this is done by the Monitoring Console (MC), not the Cluster Manager (CM).  The CM and MC can be co-located in limited conditions - see https://docs.splunk.com/Documentation/Splunk/9.3.0/Indexer/Systemrequirements#Additional_roles_for_t....

Seeing the same forwarder many times often happens when a host is cloned without first preparing the forwarder for cloning.  See the CLONEPREP installer option at https://docs.splunk.com/Documentation/Forwarder/9.3.0/Forwarder/InstallaWindowsuniversalforwarderfro....

The fix is to delete the GUID on each server (using the splunk clone-prep-clear-config command) and then restart Splunk so it generates a new GUID.  Then have the Monitoring Console generate a new forwarder assets table.