Remove missing forwarders, that have been permanently removed, reported by CMC

[markturner14]

Hi All,

I`m looking to remove missing forwarders, where the servers have been permanently removed, reported by CMC.

I cannot see anyway of doing this.  Is this something that i have to raise a support case for?

many thanks
Mark

[markturner14]

Many thanks for the replies guys.

That was what i was missing.

[livehybrid · Accepted solution]

Hi @markturner14 

The easiest way is from the Monitoring Console, Click Settings -> Forwarder Monitoring Setup, then click "Rebuild Forwarder assets..."

This will rebuild the lookup table based on the time period you select.

Alternatively you can use a search  (within splunk_monitoring_console app) or lookup editor to manually delete entries - although rebuild is generally advised instead unless you have so many forwarders that the search would take a long time to run.

|inputlookup dmc_forwarder_assets where NOT hostname IN ("host1ToRemove","host2ToRemove) | outputlookup dmc_forwarder_assets

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[richgalloway]

In the CMC, go to Forwarders->Forwarder monitoring setup and click the "Rebuild forwarder assets" button.

[PickleRick]

That causes Splunk to rebuild whole forwarders database from scratch which might be a bit resource-intensive.

If someone is brave enough and knows what they're doing, one can try to manually filter out entries from the dmc_forwarder_assets lookup. But be warned - you might break things and need to rebuild the database anyway.