Are there any ways we can check from SPLUNK GUI that UF has installed on a SERVER/HOST?

[SplunkDash]

Hello,

Are there any ways we can check from SPLUNK GUI that UF has installed on a SERVER/HOST? Any help will be highly appreciated. Thank you!

[richgalloway · Accepted solution]

Forwarders should be sending their logs to the indexers.  Search for them to verify the UF is installed, running, and able to send data.

index=_internal host=<<forwarderName>>

[SplunkDash]

Hello,

Thank you so much for your quick response, truly appreciate it. 

Yes, that is correct, but in our case.....sometimes we get data from DBConnect/UF/API from the same server. But, I understood what you meant. Thank you again.

[PickleRick]

The only thing you can check from your "central infrastructure" (indexers, monitoring console, deployment server) is whether the UF called the deployment server and whether it managed to connect to its output host(s).

You can't "pull" a state from the UF.