Splunk Enterprise

Why are there duplicate entries of my PC in Forwarder management, and how can I remove them?

tmontney
Builder

My PC is duplicated a few times in forwarder management. How can I remove duplicate entries, so I don't get missing forwarder alerts?

tzamer
New Member

I think it is because the multiple installs were not completely uninstalled according to https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Uninstalltheuniversalforwarder

Following the doc above and rebooting the machine should do the trick.

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi tmontney,

Are you running more than one forwarder on a machine so that the same hostnames show up as duplicate deployment clients?

If this is the case, you can set different servername and default-hostnames for your forwarders on the same machine to differentiate your forwarder clients.

splunk  set servername <new_servername>
splunk  set default-hostname <new_hostname>

For example, if you have two universal forwarders sending data from the same host named my_host, you can set both the servername and default hostname of the first forwarder to my_host_uf01, and those of the second forwarder to my_host_02.

Hope this helps. Thanks!
Hunter

0 Karma

tmontney
Builder

Nope. I only have one UF for each client. Originally, I had installed it a few times before during testing. It seems like it's treating each install unique (based on its GUID).

learnsplungeek
Loves-to-Learn Everything

Hi , I am facing the same issue and found this thread. Was the issue resolved ? Can you let me know the fix please if this is working for you now.
Thanks

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...