How do I create an Alert to say when there is significant change in a UF/HFs data sending to Splunk to be ingested? Thx

[SamHTexas]

Please share a SPL to alert when a UF/HF stops sending data or there is a significant change ingestion by Splunk from them. I have had times when a UF/HF stops sending or sends little all of a sudden & I find the next day or so. Thanks a million.