Deployment Architecture

What are the recommended steps to unsubscribe the forwarder at the management & deploymentserver?

armin1967
Explorer

Hi community,
a few month ago I have overtaken our Splunk cluster from a colleague who quit his job.
Now I have the situation that we dismantle some application server which has an universal forwarder installed. What are the recommended steps to unsubscribe the forwarder at the Management- & Deploymentserver? Apps and serverclasses are not affected. These are still needed.
Thanks in advance for your support.

Armin

Labels (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @armin1967,

if you disable the Universal Forwarder on this server you don't have logs anymore.

If you have this server explicitly listed in a ServerClass, you have to manually delete if from the ServerClass by UI.

if in the ServerClass you have a general rule (e.g. all Windows 32bit servers), you don't need any action.

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @armin1967,

if you disable the Universal Forwarder on this server you don't have logs anymore.

If you have this server explicitly listed in a ServerClass, you have to manually delete if from the ServerClass by UI.

if in the ServerClass you have a general rule (e.g. all Windows 32bit servers), you don't need any action.

Ciao.

Giuseppe

armin1967
Explorer

One additional hint.
After uninstalling/disabling the forwarder, you'll see after a little delay, that a forwarder is missing.
Have a look at "Settings -> Monitoring Console -> Forwarders -> Forwarders:Deployment"
To delete this record you have to "Rebuild forwarder assets ..." at "Monitoring Console -> Settings -> Forwarder Monitoring Setup".

0 Karma

armin1967
Explorer

Hi @gcusello,

thanks for your fast reply.

0 Karma

gcusello
Esteemed Legend

Hi @armin1967,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...