Manage the forwarder monitoring setup

The CMC Forwarder Monitoring Setup page helps Splunk Cloud Platform administrators manage your forwarder monitoring configuration. This includes periodically removing decommissioned forwarders to improve system performance.

Because they are configuration pages, the Forwarder Monitoring Setup pages for Splunk Cloud Platform CMC and Splunk Enterprise Monitoring Console are similar. For more information on understanding and using this configuration page, see About time settings and Rebuild the forwarder asset table in the Monitoring Splunk Enterprise manual.

Note: A difference between Splunk Cloud Platform CMC and the Splunk Enterprise Monitoring Console is the lookup file name. For CMC, enabling forwarder monitoring runs a scheduled search that populates the sim_forwarder_assets.csv.gz lookup file.

Review the Forwarder Monitoring Setup page

To investigate this page, go to Cloud Monitoring Console > Forwarders > Forwarder Monitoring Setup.

Note: After upgrading to CMC version 3.22.0, select '''Rebuild forwarder assets''' to ensure the data displays accurately.

The top section of the page is where you set whether forwarder monitoring is enabled and the data collection time interval, or disable it. Complete the following steps to enable forwarder monitoring.

  1. Select Enable.
  2. Choose a time option in Data Collection Interval.
  3. Select Save.
  4. Choose an option in the the Build Forwarder Assets Now dialog box that appears.
    1. Select Continue to start the forwarder assets rebuild process. This process lets you immediately rebuild the forwarders assets table, which removes decommissioned forwarders from the deployment and improves performance. Messages appear that indicate the state of this process and when it completes.
    2. Select Later if you want the forwarder assets table automatically rebuilt during the next daily update process.

Select Reset to reset the forwarder monitoring setup back to the previous configuration.

Note: Be sure to select Save after making any configuration changes.

The bottom section of the page lets you immediately rebuild the forwarder assets table to remove any decommissioned forwarders. Complete the following steps.

  1. Select Rebuild forwarder assets...
  2. Choose an option in Time Range.
  3. Select Start Rebuild.

CAUTION: Depending on the number of forwarders in your deployment, rebuilding the forwarder assets table can affect indexer performance and take a significant amount of time to complete.