Windows server installs a universal forwarder and receives data, but sometimes the forwarder is shut down. If you look at the internal log, it seems that there is an error in perfmon.exe.
What information should you look at and can you recommend related data?
Open a case with Splunk Support.