You can create a lookup of uf connections to your Splunk instance. Here's an example of something that I've used: index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log earliest=-1h@h | stats latest(_time) as _time latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build latest(fwdType) AS type latest(sourceIp) AS src_ip by hostname | eval last_seen_epoch=_time | eval last_seen_date=strftime(_time,"%Y-%m-%d") | eval nt_host=UPPER(hostname) | append [| inputlookup splunk_forwarder_client_version_lookup.csv] | dedup nt_host | eval last_seen_age = ROUND((now()-last_seen_epoch)/86400, 0) | where last_seen_age < 31 | table nt_host arch os build version type src_ip last_seen_age last_seen_date last_seen_epoch | outputlookup splunk_forwarder_client_version_lookup.csv   ... View more

Can you see those nodes on MC’s forwarders? This needs enabling forwarder monitoring on mc - setup tab. Another option is do a query  index=_internal | stats count by host That query shows if those nodes can send their internal logs to splunk. You should check that your server haven’t blocked port 9997/tcp by host based firewall. Open that port if needed. Also ensure that you have ticked “reboot” box on fwd management. Otherwise splunk just install those configurations to UFs, but don’t take those to use with rebooting UF. r. Ismo ... View more

Thank you again for your help! looks like we are good to go. Happy Splunking 🙂 ... View more

Hey scelikok, yes your solution worked. Sorry for the lack of details, I can only share so much. Thank you! ... View more