Unanswered question about duplicate forwarders after upgrading

[tylermonteith]

Here is an old post from 2019 that was unanswered.

https://community.splunk.com/t5/Deployment-Architecture/Remove-missing-duplicate-forwarders-from-for...

I am running into the same issue. Splunk Enterprise 9.2.2. Basically we had maybe 400+ machines with version 9.0.10. When upgrading to a newer splunkforwarder 9.2.2 under Forwarder Management there is duplicate instances of the computers. Pushing our Clients now to above 800. How can you remove the duplicates with going through each duplicate and clicking delete Record?

Thanks

[PaulPanther]

You have two options:

1. Rebuild the Forwarder Asset table in the DMC

2. Create a custom search to identify duplicate hostnames and remove these entries of missing forwarder in the lookup file dmc_fowarder_assets.csv that is located in the splunk_monitoring_console app

[tylermonteith]

But can you give me a bit more on the Rebuild Forwarder Asset table in the DMC? And do you have maybe how that search would look? I have basically generally searched for specific users in the search and reporting field. So any more pointing in the direction would help. But in the interim, I will start looking into this as a solution and work towards it. Appreciate it

[PaulPanther · Accepted solution]

|inputlookup dmc_forwarder_assets.csv
| sort - last_connected hostname
|streamstats count by hostname
|search status=active OR (status=missing AND count=1)
|fields - count
| outputlookup dmc_forwarder_assets.csv