I need to de-commission one of our Windows Servers which had a splunk forwarder installed. Once I uninstalled the forwarder I'm flooded with these errors on my splunk server (Windows-based):
Type=Error
User=NULL
ComputerName=splunk
OriginalComputerName=xxxxxxxxxx
wmi_type=WinEventLog:System
Message=DCOM was unable to communicate with the computer xxxxxxxxx using any of the configured protocols.
I've seen these errors come up when a server is down which is fine but I how can I make splunk realize that this server will be off for good?
Appreciated
To answer my own newbie question I realized that aside from getting logs from splunk forwarders I also had remote inputs set individually for all my servers.
I had a feeling that this was really easy 🙂