How can I alert and send email when unversalforwarder stops forwarding log to splunk server or got stopped?
Install the Deployment Monitor App. There is a saved search pre-built for a lot of forwarder operations, including notifications when Forwarders are down.
http://splunk-base.splunk.com/apps/67836/splunk-deployment-monitor
This app is no longer available. Do you know of a replacement?
