Using the Splunk v663 UF in the window 2012 server.Find that Splunk can't collect the WinHostMon event suddenly from time to time. Need to restart the UF to get the events back.
Checking the log file, it seems winhostinfo is going down, it will have the message:
“Couldn’t start command “c:\Program Files\Splunk\UniversalForwarder\bin/splunk-winhostinfo.exe” : Access is denied. “