With something like that
|tstats count where index=* by host you will get an overview which hosts are active.
Do you know your network and which hosts have a UF installed or which hosts work as a Heavy Forwarder?
| tstats count where index=* host=UFHOSTNAME by index,source,sourcetype
by the above query you will be able to see what are all the logs you are looking from the required Universal forwarder on search head. Then you can understand if the intended data is flowing through UF-->HF-->Indexer
|tstats count values(source) where (index=* OR index=_*) AND host="YourHostHere" BY sourcetype
If it does not show, see if you are using the correct
YourHostHere with a broader search like this:
|tstats count values(source) where (index=* OR index=_*) BY host
Be sure to check both the original host and your HF host.