How to get the list of UF & HF in Splunk Cloud?

[alexspunkshell]

How to get UF & HF list in Splunk Cloud

[Roy_9]

@alexspunkshell You can view by navigating to forwarder management else you can try the below query 


index="_internal" source="*metrics.lo*" group=tcpin_connections fwdType=uf | dedup hostname| table hostname,sourceIp,fwdType,guid,version,build,os,arch

[alexspunkshell]

@Roy_9 @richgalloway 

How to check the forwarders/host which is not reporting for more than 60 days.

[richgalloway]

It's possible the computer was taken out of service.

If it's still there, login to the box and confirm the forwarder is present and running.  Re-installed or restart it, as necessary.  To help avoid this problem in the future, make sure the UF is configure to start at boot-up.  Consider using GPO or similar features to ensure the UF stays installed and running.

[richgalloway]

See the Forwarders menu in the Cloud Monitoring Console app.