Splunk Enterprise

How to Fix missing Forwarder issue. The MC "Rebuild Forwarder Assets" for 24 hours did not help! Thank u very much

SamHTexas
Builder

I used to clear all missing FWs in the Splunk Ent. using the MC "Rebuild" option. But it is not working anymore. Any helpful advice is much appreciated.

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please elaborate on "did not help" and "is not working anymore".  What results do you get and what did you expect?

Please understand the "Rebuild Forwarder Assets" button does not fix anything.  It essentially tells the MC to forget forwarders it hasn't seen in a while so they're no longer "missing".  The forwarders are still gone, they're just not reported.  The true fix is to restart the forwarder.

---
If this reply helps you, Karma would be appreciated.
0 Karma

SamHTexas
Builder

Thank u for your message. I appreciate it as always. What I mean it the "rebuild forwarder assets" option did not reduce the number of missing FWs even by changing the duration. It stayed about 17. Usually this option would bring the number of the missing FWs down to 1 or 2. Thank u sir.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...