Getting Data In

Universal Forwarder


Can we detect following from UFs internal logs:

Is TCP connection failed between UF and indexer/HF.

If UF dropped some logs for example from source A, there were 5 logs generated but sent only 4.(data loss)

Failed to monitor certain path or application.

Or are there any other useful info we can fetch from UFs internal logs???

Need to have health check over such 1000UFs.

PS: we don't have access to any other logs, not even indexers internal logs but only UFs logs.


0 Karma

Esteemed Legend

Hi @hectorvp,

at first check the connection between your UF and the Indexer, e.g. using telnet (telnet indexer_IP_address 9997).

if it's open, you need to access the internal logs on Search head to understand if the UF is sending logs or not.

If it's closed, you have to solve this problem.



0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...