Hi, I receive alerts about : DMC Alert - Missing forwarders :
| inputlookup dmc_forwarder_assets
| search status="missing"
| rename hostname as Instance
it's telling me 3 forwarders are missing, old forwarders since the version is 8.2.1 and we are in 9.0.4.
If I search | inputlookup dmc_forwarder_assets then the result is good, and there are no missing instances anymore ! Where are the 3 missings forwarders actually coming from ? Regarding the Rebuild forwarder assets in the MC does not change anything since the .csv /opt/splunk/etc/apps/splunk_monitoring_console/lookups/dmc_forwarder_assets.csv is showing the right result. My issue is the alerts reporting wrong informations. Any ideas ? Ofc I can provide further informations. Thanks
... View more