Deployment Architecture

What are the recommended steps to unsubscribe the forwarder at the management & deploymentserver?

armin1967
Explorer

Hi community,
a few month ago I have overtaken our Splunk cluster from a colleague who quit his job.
Now I have the situation that we dismantle some application server which has an universal forwarder installed. What are the recommended steps to unsubscribe the forwarder at the Management- & Deploymentserver? Apps and serverclasses are not affected. These are still needed.
Thanks in advance for your support.

Armin

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @armin1967,

if you disable the Universal Forwarder on this server you don't have logs anymore.

If you have this server explicitly listed in a ServerClass, you have to manually delete if from the ServerClass by UI.

if in the ServerClass you have a general rule (e.g. all Windows 32bit servers), you don't need any action.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @armin1967,

if you disable the Universal Forwarder on this server you don't have logs anymore.

If you have this server explicitly listed in a ServerClass, you have to manually delete if from the ServerClass by UI.

if in the ServerClass you have a general rule (e.g. all Windows 32bit servers), you don't need any action.

Ciao.

Giuseppe

armin1967
Explorer

One additional hint.
After uninstalling/disabling the forwarder, you'll see after a little delay, that a forwarder is missing.
Have a look at "Settings -> Monitoring Console -> Forwarders -> Forwarders:Deployment"
To delete this record you have to "Rebuild forwarder assets ..." at "Monitoring Console -> Settings -> Forwarder Monitoring Setup".

0 Karma

armin1967
Explorer

Hi @gcusello,

thanks for your fast reply.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @armin1967,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...