Hi Some comments even this is a old post. DMC/MC (if you have configured forwarders there) shows all nodes which have sent any _internal log events to indexers were MC will look those periodically and create a lookup file for them. Basically this means that until those events are in _internal log you will see those in MC forwarder dashboard. I think that DS's forwarder management use REST request from clients (DC) to keep book what DCs are active. Actually this means that until DC make a poll DS didn't know it. This same will happen always after you 1) reboot splunk and/or you reload deploy-config after changes. The "missing time" will depends on how often your clients are polling DS. Default is 1min phoneHomeIntervalInSecs = <decimal> * How frequently, in seconds, this deployment client should check for new content. * Fractional seconds are allowed. * Default: 60. Depending on your environment you could/should increase this to e.g. 5min. Another thing. You should never use system/local to store any configuration (there are some exceptions). Especially for DC configurations should be under own app. That way you can manage those via DS instead of managing those locally. r. Ismo

Hi @twanie , as @bowesmana said, it isn't possible because Splunk isn't a database: in the index you have day by day all the events, and it's not possible to delete or replace them, in this way you have also the history of your data. If you want a table that you can replace every day, you could save the results of your query in a lookup that you recreate every day. Ciao. Giuseppe

Hi @ericg57, I agree with you: I don't remember that it's possible to change the monitoring interval but why do you want this? It's better to have the new events as soon as possible, and they are read in near real time. The solution with a script is possible but it makes the same job of the monitor command, so why? Ciao. Giuseppe

The message appeared for forwarders (search head cluster) upgraded in 9.1.2 settings:  forceTimebasedAutoLB = false useACK = true autoLBFrequency = 30 Upgrading don't change the behavior on full enterprise splunk   But this seems to work on Universal Forwarder