Splunk Enterprise

Why are there duplicate entries of my PC in Forwarder management, and how can I remove them?


My PC is duplicated a few times in forwarder management. How can I remove duplicate entries, so I don't get missing forwarder alerts?

New Member

I think it is because the multiple installs were not completely uninstalled according to https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Uninstalltheuniversalforwarder

Following the doc above and rebooting the machine should do the trick.

0 Karma

Splunk Employee
Splunk Employee

Hi tmontney,

Are you running more than one forwarder on a machine so that the same hostnames show up as duplicate deployment clients?

If this is the case, you can set different servername and default-hostnames for your forwarders on the same machine to differentiate your forwarder clients.

splunk  set servername <new_servername>
splunk  set default-hostname <new_hostname>

For example, if you have two universal forwarders sending data from the same host named my_host, you can set both the servername and default hostname of the first forwarder to my_host_uf01, and those of the second forwarder to my_host_02.

Hope this helps. Thanks!

0 Karma


Nope. I only have one UF for each client. Originally, I had installed it a few times before during testing. It seems like it's treating each install unique (based on its GUID).

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...