Splunk Search

How to avoid DCOM errors when de-commissioning servers?

clymbouris
Path Finder

I need to de-commission one of our Windows Servers which had a splunk forwarder installed. Once I uninstalled the forwarder I'm flooded with these errors on my splunk server (Windows-based):

Type=Error
User=NULL
ComputerName=splunk
OriginalComputerName=xxxxxxxxxx
wmi_type=WinEventLog:System
Message=DCOM was unable to communicate with the computer xxxxxxxxx using any of the configured protocols.

I've seen these errors come up when a server is down which is fine but I how can I make splunk realize that this server will be off for good?

Appreciated

Tags (2)
0 Karma

clymbouris
Path Finder

To answer my own newbie question I realized that aside from getting logs from splunk forwarders I also had remote inputs set individually for all my servers.

I had a feeling that this was really easy 🙂

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...