The following Splunk query was modified from the Splunk Health Overview app on Splunkbase. This particular Splunk search returns a list of hosts with their indexes and sourcetypes and determines when each last sent data. This query can help diagnose which Splunk Universal Forwarders may be having issues sending data, or simply stopped sending a certain type of data.

| tstats latest(_time) as Latest where index=* by host sourcetype index 
| eval current=now() 
| eval Minimum_Age=round(((current-Latest)/60)/60,2) 
| rangemap field=Minimum_Age default=Critical Normal=0-0.5 Elevated=0.5-2 Warning=2-4
| eval stIDX=tostring(index) + " -- " + tostring(sourcetype)
| stats values(stIDX) as "Index -- Sourcetype" list(Latest) as "Latest Event" list(Minimum_Age) as Minimum_Age list(range) as Threshold by host 
| convert ctime("Latest Event") 
| eventstats avg(Minimum_Age) as average by host 
| eval average=round(average,2) 
| sort - average
| rename Minimum_Age as "Hours Since Last Communication" average as "Average Time in Hours Since Last Communication"