My PC is duplicated a few times in forwarder management. How can I remove duplicate entries, so I don't get missing forwarder alerts?
I think it is because the multiple installs were not completely uninstalled according to https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Uninstalltheuniversalforwarder
Following the doc above and rebooting the machine should do the trick.
Hi tmontney,
Are you running more than one forwarder on a machine so that the same hostnames show up as duplicate deployment clients?
If this is the case, you can set different servername and default-hostnames for your forwarders on the same machine to differentiate your forwarder clients.
splunk set servername <new_servername>
splunk set default-hostname <new_hostname>
For example, if you have two universal forwarders sending data from the same host named my_host, you can set both the servername and default hostname of the first forwarder to my_host_uf01, and those of the second forwarder to my_host_02.
Hope this helps. Thanks!
Hunter
Nope. I only have one UF for each client. Originally, I had installed it a few times before during testing. It seems like it's treating each install unique (based on its GUID).
Hi , I am facing the same issue and found this thread. Was the issue resolved ? Can you let me know the fix please if this is working for you now.
Thanks