Getting Data In

How to get list of Universal forwarders that are no longer sending logs


Hi Folks,

We have thousands of universal forwarders that are currently running on old version (7.0.2). We are planning to upgrade universal forwarders to most recent version but before we do that we would like to reduce the overall footprint of universal forwarders by uninstalling them from the servers that are no longer sending logs.

 Logs for few applications and infrastructure are migrated to Azure so they are no longer sending it to splunk.

Need to find a list of such servers so i can uninstall them before i do mass upgrade. Is there a query that can give me the list of hostname along with timestamp of last log that it sent.

Thanks in advance

Labels (1)
0 Karma


If you are using Forwarder Monitoring in the Monitoring Console, you can find all forwarders that were sending logs to your environment (from the last inventory reset point).

0 Karma


Hi @koyachi,

you can list all the Forwarders that sent logs in a period (e.g. 90 days) and that don't send logs from 7 days using a search like the following

| tstats count latest(_time) AS latest WHERE earliest=-90d@d latest=now BY host
| where latest<now()-(86400*7)
| eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S")
| table host latest

Obviously, you can use the time periods you need in this search.



0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...