how does these vms send data to splunk?
| tstats max(_time) as last_event where index=* by host
that will give you the last time (in epoch) a host (maybe a vm) reported to splunk
If you need specifically UFs, then you could use below but the search will be slow.
index="_internal" source="*metrics.log*" group=tcpin_connections fwdType=uf |stats count by hostname|fields - count