Getting Data In

DMC ALert - Missing forwarder for zombie entry

afx
Contributor

Hi,
I am getting a DMC alert for a missing forwarder even though that one (at least by client name, but not UUID) exists.

Backgroud story:
Forwarder was deleted completely on source system (don't ask...).
Re-Installed from scratch with same parameters (of course, still different UUID, but same client name) and slightly newer code version.
Rebuilt the forwarders DB on the deployment server (Monitoring Console -> Settings -> Forwarder Monitoring Setup -> Rebuild forwarder assets).
Still I get errors about the missing forwarder and it shows the old version number for the code.

So where is this Zombie stored and how do I get rid of it?

thx
afx

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi afx,
did you tried to rebuild the lookup "dmc_forwarder_assets" [Settings -- Forwarder Monitoring Setup -- Rebuild Forwarder Assets].
In this way you rebuild your lookup with only the UFs that are really sending logs in the last period (configurable).

Bye.
Giuseppe

0 Karma

afx
Contributor

Hi Guiseppe,
yes, as described in my post.

But, your post suddenly triggered my leaky memory.
It is not the deployment server where these alerts are generated but the search head for various strange reasons (modifed DMC alert with some lookups that are only maintained on the search head that make the alert more informative).

So once I did the DB refresh on the search head the world went quiet again.

thx
afx

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi afx,
if this answer solved your problem (or helped to do), please accept and/or upvote it.
Bye and see next time.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...