Deployment Architecture

Forwarder Management - Duplicated hosts

mikelanghorst
Motivator

Recently I looked at the Forwarder Management page, and selected the "Phone Home: Later than Expected". A large number of hosts were listed here, but when I filtered for the individual hosts, and set it back to Phone Home: All, I found that the host was listed multiple times.

Now some of them were likely related to DHCP IP's being changed. But several of them have static IP's.

The page shows that the Host Name, Client Name, IP Address, are all the same. Yet one entry shows a Phone Home of 12 hours ago, while the other shows a few seconds ago.

Why the duplicates?

Tags (1)
0 Karma

mikelanghorst
Motivator

After opening a support case, I was told this was a known bug being worked on and should be in an upcoming release. The OpenSSL bug was the only fix for 6.0.3, so I'd expect it to likely be in 6.0.4.

cedarcrestone
Explorer

I have started to see the same behavior in our environment. I wish there was a way to see the duplicate ones and have those removed either automatically or some other way.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...