Cloud Monitoring Console - Rebuild forwarder assets

[Tiny_Trex]

When going to CMC -> Forwarders -> Forwarders: deployment, I see that we have 19k+ forwarders, which is completely inaccurate. We have more like 900. It shows 18k+ as missing, and the list has instances decommissioned years ago. 

I thought I could fix this by telling it to rebuild the forwarder assets via the button under VMC -> Forwarders -> Forwarder monitor setup, but when I click on this, it processes for about a minute, and then nothing changes.

The description makes me think it is supposed to clear out the sim_forwarder_assets.csv lookup and rebuild it using only data it sees within the time frame I selected (24 hours). If I open up the lookup, all the entries it had previously are still there. 

Am I misunderstanding how this works, or is something broken?

[bwheel]

There are 2 options. 1 is the regular 'update' which you have selected, and then an additional 'rebuild forwarder assets' button that will do a complete rebuild.

They both use saved searches, one is the update which is activated when you select 'Enable', and the other you can setup for a regular rebuild to clear out the older forwarders if you wish. Especially useful when you have AWS or similar that regularly redeploys environments.

Some more detail available at:
Use the Forwarder dashboards - Splunk Documentation

[Tiny_Trex]

Hey, thanks for taking the time to reply, bwheel, but I think you might have misread my post. I stated that I was clicking the "Rebuild forwarder Assets..." button. I'm not sure what you're referring to with the "regular 'update'" you mention. I also couldn't find any mention of an "update" option in the document you linked. Maybe I'm misunderstanding what you're saying, but either way please don't spend any further time on it.

I opened a support case about the fact it didn't work, and they said it was a bug and provided me with a search to update the lookup table manually. I think they might have fixed it at this point. I seem to recall using it not too long ago.