Splunk Search

How to avoid DCOM errors when de-commissioning servers?

clymbouris
Path Finder

I need to de-commission one of our Windows Servers which had a splunk forwarder installed. Once I uninstalled the forwarder I'm flooded with these errors on my splunk server (Windows-based):

Type=Error
User=NULL
ComputerName=splunk
OriginalComputerName=xxxxxxxxxx
wmi_type=WinEventLog:System
Message=DCOM was unable to communicate with the computer xxxxxxxxx using any of the configured protocols.

I've seen these errors come up when a server is down which is fine but I how can I make splunk realize that this server will be off for good?

Appreciated

Tags (2)
0 Karma

clymbouris
Path Finder

To answer my own newbie question I realized that aside from getting logs from splunk forwarders I also had remote inputs set individually for all my servers.

I had a feeling that this was really easy 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...