How can I alert and send email when unversalforwarder stops forwarding log to splunk server or got stopped?
Install the Deployment Monitor App. There is a saved search pre-built for a lot of forwarder operations, including notifications when Forwarders are down.
This app is no longer available. Do you know of a replacement?