Monitoring Splunk

Forwarders list in monitoring console

riqbal47010
Path Finder
| inputlookup dmc_forwarder_assets | search hostname="abc-t1"

above lookup showing me duplicate hostname. we upgrade the universal forwarders from 7.1.2 to 7.3.1. now it is showing two entries. one with old connector version and 2nd with newer version. from newer version it is showing that system is receiving events from this source. interestingly both records have different guid. attaching snapshot for you better understanding.

my question is that how can

1 - update the dmc_forwarder_assets manually but exludeing null values
2- OR there is some way from workstation side to fix this issue.

alt text

Tags (1)
0 Karma

woodcock
Esteemed Legend

The only reason that I can see for multiple GUIDs is either that the UF was removed and then reinstalled (as opposed to simply upgraded) or that you have multiple UFs installed on the same server. There are several good reasons why you might install multiple UFs. One is if you are forwarding compressed files. The Archive Processor (AKA AQ and AEQ) is single-threaded and so throughput suffers greatly when forwarding these.

0 Karma

rvaglid
Explorer

Hi there, how did you upgrade the UFs? If you remove the whole /opt/splunkforwarder and then installed 7.3.1.1, a new guid would have been generated.

The GUID (since 5.x) gets stored in
$SPLUNK_HOME/etc/instance.cfg, ref.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Instancecfgconf

Cheers,
Rolf

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...