Splunk Enterprise
Highlighted

Why are there duplicate entries of my PC in Forwarder management, and how can I remove them?

Contributor

My PC is duplicated a few times in forwarder management. How can I remove duplicate entries, so I don't get missing forwarder alerts?

Highlighted

Re: Why are there duplicate entries of my PC in Forwarder management, and how can I remove them?

Splunk Employee
Splunk Employee

Hi tmontney,

Are you running more than one forwarder on a machine so that the same hostnames show up as duplicate deployment clients?

If this is the case, you can set different servername and default-hostnames for your forwarders on the same machine to differentiate your forwarder clients.

splunk  set servername <new_servername>
splunk  set default-hostname <new_hostname>

For example, if you have two universal forwarders sending data from the same host named myhost, you can set both the servername and default hostname of the first forwarder to myhostuf01, and those of the second forwarder to myhost_02.

Hope this helps. Thanks!
Hunter

0 Karma
Highlighted

Re: Why are there duplicate entries of my PC in Forwarder management, and how can I remove them?

Contributor

Nope. I only have one UF for each client. Originally, I had installed it a few times before during testing. It seems like it's treating each install unique (based on its GUID).

0 Karma
Highlighted

Re: Why are there duplicate entries of my PC in Forwarder management, and how can I remove them?

New Member

I think it is because the multiple installs were not completely uninstalled according to https://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Uninstalltheuniversalforwarder

Following the doc above and rebooting the machine should do the trick.

0 Karma