ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-1003 All Questions

View all questions & answers for the SPLK-1003 exam
Go to Exam

Exam SPLK-1003 topic 1 question 47 discussion

Actual exam question from Splunk's SPLK-1003
Question #: 47
Topic #: 1
[All SPLK-1003 Questions]

How do you remove missing forwarders from the Monitoring Console?

  • A. By restarting Splunk.
  • B. By rescanning active forwarders.
  • C. By reloading the deployment server.
  • D. By rebuilding the forwarder asset table.
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
Reference:
https://answers.splunk.com/answers/447096/how-to-remove-missing-forwarders-from-the-distribu.html
by ames at Sept. 2, 2020, 8:12 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
ames
Highly Voted 2 years, 3 months ago
D is correct. More info here <https://docs.splunk.com/Documentation/Splunk/7.3.1/DMC/Configureforwardermonitoring#Rebuild_the_forwarder_asset_table>
upvoted 7 times
ucsdmiami2020
1 year, 2 months ago
Agreed D. Quoting the reference URL "The data in the forwarder asset table are cumulative. If a forwarder connects to an indexer, its record exists in the table. Then if you later remove the forwarder from your deployment, the forwarder's record is not removed from the asset table. It is instead marked "missing" in the asset table, and it still appears in the DMC forwarder dashboards. To remove a forwarder entirely from the DMC dashboards, click rebuild forwarder assets ...
upvoted 3 times
...
...
Apis
Most Recent 11 months, 1 week ago
Selected Answer: D
D is correct
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel