Detect gaps in Windows Universal forwarder eventstrem

[coenvandijk]

Hello,

We have Splunk 6 running with Universal forarders on all our Windows servers. The forwarders are used to transfer,a subsect as configured in inputs.conf of the Windows TA, to the indexers (a cluster of 2 indexers) How can I see if there have been gaps in the data forwarderd to the indexers?

Thanks in advance!
Coen

[nickhills]

Take a look at MetaWoot https://splunkbase.splunk.com/app/2949/
It will give you a high degree of confidence in which of your sources are (or are not) working!