Rebuild forwarder assets does not actually rebuild the assets table

[Omar]

Hello Splunkers,

To remove the old decommissioned UFs and stop the annoying missing alert "DMC Alert - Missing forwarders" we need to Rebuild forwarder assets. 

The issue is even after doing so, the table still contains old decommissioned UFs, How do we solve this?

[gcusello]

Hi @Omar ,

the build of the asset lookup is done running a search on _internal.

So, before running rebuilding, check the duration of the time period, maybe it's too large and there are still events from the decommisioned Forwarders, it's usually 24 hours.

Ciao.

Giuseppe

[Omar]

Hi Giuseppe,

Thanks for the replay. However, the issue is that it does not delete the old table,

Splunk says: "The Monitoring Console deletes the existing table and uses input metrics from indexers to create a new table."


I find many forwarders in the "dmc_forwarder_assets" lockup table which belongs to agents that last connected in the year 2022 

[gcusello]

Hi @Omar,

as I said, check the time periodo used to rebuild the lookup.

If the issue is only to delete old forwarders, as a workaround, you could try to manually delete all the records in the lookup  "dmc_forwarder_assets" opening it in Lookup Editor.

Ciao.

Giuseppe