Why do some UFs show as missing by Monitoring console & active when viewing the MC ?

[SamHTexas]

Why do some UFs show as missing by Monitoring console & active when viewing the MC ? And the number of them keep going up & down ! What needs to checked please?

[richgalloway]

Please describe the problem in a little more detail.  "Monitoring Console" and "MC" are the same thing so I would expect the same display.  What exactly are you looking at that is confusing you?  Include screenshots, if possible.

It's often normal for UFs to disappear for a while.  The workstation they're on may reboot, they may reboot themselves when installing an app, network connectivity may fail, etc.

[SamHTexas]

Thank u for your message. Looking in monitoring console , running the missing forwarder search under health check. List a few forwarders with status of "missing" but looing to the right under status says "active". One more question please. In the environment I have inherited. There are 2 monitoring consoles in distributed mode with only 1 with peers defined. In addition, on 2 more servers there are monitoring consoles in stand alone & no peers defined. Is this over doing it? Using too much resources for the same purpose? Thank u as always.

[richgalloway · Accepted solution]

I can't explain the conflict of information in the MC.

I can say, however, that you only need one MC in distributed mode.  Choose one to keep and make sure it is peered with all other instances (except forwarders).  Set all the others to standalone mode.  All Splunk instances have the MC built-in and defaulting to standalone mode.  There's no extra load involved for them when the MC is not in use.