How to see when UF last send log to Splunk?

[saibal_das]

I have multiple UF (Universal Forwarder) in my environment and all of those are sending logs to one IF (Intermediate Forwarder).

Now suddenly one UF has installed in syslog server and suddenly that UF stopped sending log to Splunk. How can I get to know when that UF last send the log to Splunk and if I try to search that UF name as host. Shall I get it or I will get only two IF name as host for every time?

[Note: Please attach the splunk doc link for the same if you know]

[PickleRick]

Firstly, check if you have any data in _internal index from this UF.

If you the _internal index stopped receiving index from this UF, most probably indeed the connectivity from that UF broke down. If however you're still receiving the _internal events from UF but are not receiving the "production" data, there's something wrong with the rest of the configuration (inputs probably).

If you no longer receive data into _internal index from this UF, look in to $SPLUNK_HOME/var/log/splunk/splunkd.log for errors on the machine that the UF is installed on.

[VatsalJagani]

If you wish to see whether UF is correctly connected and sending logs or not.

index=_internal sourcetype=splunkd
| stats max(_time) as last_connected by host
| eval current_time=now(), status = if(last_connected < (current_time - 3600), "Missing", "Active")
| eval last_connected = strftime("%F %T", last_connected)

Run this query in the last 4 hours or 24 hours and it will generate a status as "Missing" for the host which is not sent data for more than the last hour.

You can change 3600 seconds (1 hour) to a time of your choosing, like if you want to get notified if the forwarder does not send data for 10 minutes (600).

This will work for all the Splunk instances, not just UF.

I hope this helps!!!