How to search the number of times a universal forwarder went down in a day?

[splunker9999]

Hi ,

We are facing an issue with our universal forwarder where the Splunk agent on universal forwarder is going down regularly.

We need to identify how many times the forwarder went down on a host. Can some one please provide me the search?

Thanks

[inventsekar]

check out the deployment monitor app https://apps.splunk.com/app/1294/ which includes such searches like missing forwarder and other stuff which can be useful.
Also check out the S.o.S app https://apps.splunk.com/app/748/ or if you're using Splunk 6.2 have a look at the http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole

a long route - maybe, you can write a small script to do ps -ef grep splunk uf process, and check the write down to a log file and send it to splunk, then search on this.