How to ensure we are receiving data from all UF?

[izzie123]

Hi

How can we find out the list of universal forwarders sending data to Splunk?

Also, how do we ensure that all the UF that have been configured are sending data to Splunk?

Thank you so much in advance

[richgalloway]

The Monitoring Console will have a list of UFs if you've enabled forwarder monitoring.  You also can get a list of UFs from the Deployment Server.

The TrackMe app (https://splunkbase.splunk.com/app/4621) can help you see which UFs are not sending data.

[izzie123]

Thank you for your answer, it helped.

Is there any way we can do it inline using a script?

[richgalloway]

Do *what* exactly using a script?  What do you mean by "script"?  

You can click on the magnifying glass icon in the MC's Forwarder dashboard panels to see the SPL that is used to populate that panel.  Then you can copy that SPL to use in your own query.