I have about 30 production boxes i'd like to monitor. I have been going through and installing the windows forwarder on the machines and they go on fine showing i'm connected to my indexer. My question is, why are some of the machines not showing up in "hosts" and some are. All of the machines i'm adding are appearing in forwarder monitoring, but not in forwarding management. Some are showing up in hosts and some are not. How do i sync whats showing in forwarding monitor to the rest of my instance?
Thanks
Forwarders will only show up in forwarder management if you have a deployment server configured and your forwarders are set as deployment clients.
When you say deployment server, what exactly do you mean by this? Something in addition to my indexer you mean?
Yes. See the documentation below.
https://docs.splunk.com/Documentation/Splunk/7.2.6/Updating/Aboutdeploymentserver