How do you remove missing forwarders from the Monitoring Console?

The correct answer is D. By rebuilding the forwarder asset table.. In Splunk's Monitoring Console, stale or missing forwarder entries are removed by rebuilding the forwarder asset table. This process re-queries the internal forwarder tracking data and regenerates the asset list, clearing out entries for forwarders that are no longer reporting. S

Splunk Forwarding

Question

Options

ABy restarting Splunk.
BBy rescanning active forwarders.
CBy reloading the deployment server.
DBy rebuilding the forwarder asset table.

How the community answered

(36 responses)

B
6% (2)
C
3% (1)
D
92% (33)

Explanation

In Splunk's Monitoring Console, stale or missing forwarder entries are removed by rebuilding the forwarder asset table. This process re-queries the internal forwarder tracking data and regenerates the asset list, clearing out entries for forwarders that are no longer reporting. Simply restarting Splunk, rescanning active forwarders, or reloading the deployment server will not clear the stale forwarder entries from the Monitoring Console's asset table.

Topics

#Forwarder management#Monitoring Console#Asset table cleanup

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice