topic Re: How to ensure we are receiving data from all UF? in Splunk Enterprise

How to ensure we are receiving data from all UF?

izzie123 — Mon, 02 Jan 2023 15:59:42 GMT

How can we find out the list of universal forwarders sending data to Splunk?

Also, how do we ensure that all the UF that have been configured are sending data to Splunk?

Thank you so much in advance

Re: How to ensure we are receiving data from all UF?

richgalloway — Tue, 03 Jan 2023 01:08:57 GMT

The Monitoring Console will have a list of UFs if you've enabled forwarder monitoring. You also can get a list of UFs from the Deployment Server.

The TrackMe app (https://splunkbase.splunk.com/app/4621) can help you see which UFs are not sending data.

Re: How to ensure we are receiving data from all UF?

izzie123 — Tue, 03 Jan 2023 03:58:17 GMT

Thank you for your answer, it helped.

Is there any way we can do it inline using a script?

Re: How to ensure we are receiving data from all UF?

richgalloway — Tue, 03 Jan 2023 14:20:05 GMT

Do *what* exactly using a script? What do you mean by "script"?

You can click on the magnifying glass icon in the MC's Forwarder dashboard panels to see the SPL that is used to populate that panel. Then you can copy that SPL to use in your own query.