Is there a work around for forwarders:deployment / duplicated forwarders?

[amelguizo]

Hello, 

I got duplicated forwarders reported in Cloud Monitoring Console. It appears the same amount of forwarders in active and missing status. Please, some workaround ? Rebuilding the forwarder asset could be and option ?

Forwarders report to Splunk Cloud through a Heavy Forwarder instance

(Splunk Cloud)

Thanks!

[x3ncrypt]

I have the same issue too. Cloud Monitoring Console was recently updated to a new version on 26/09. I have a ticket with Splunk technical support, it might be a bug.

[isoutamo]

Hi

have you updated those by uninstalling and then installing a new version? If yes, then you have generated a new GUID for those UF and that means a new UF even it has the same name than earlier. When you are updating, just update it over old instance. 

You can get rid of those by rebuilding asset lookup as you suggested.

r. Ismo

[amelguizo]

Thanks for your answer!

I have rebuilt the asset lookup, but it didn't work. The number of forwarders still remains duplicated, half in active status, and the rest in active

Some suggestion ?

[isoutamo]

Can you give more information about this? Are all fwds duplicated and when those are switched to inactive and still in active? Are the name same, but GUID different etc?