Datamodels not working on some user endpoints

Hi. I have uberAgent installed on 1200+ endpoints (laptops) across my company, all of them forwarding data to splunk. uberAgent is sending data to a locally installed splunk universal forwarder on every endpoint via port 19500. 

Now the problem is, some of the uberAgent datamodels are not being populated by data from all the endpoints. For e.g. "uberAgent.Application_ApplicationUsage" datamodel is only capturing data from ~650 endpoints, same is the case with "uberAgent.System_NetworkConfigInformation". All other datamodels are working fine. The endpoints are all configured similarly and there is no difference in OS/hardware as well. Any leads on how to troubleshoot this? 




  • Avatar
    Martin Kretzschmar Official comment

    Hi Saad,

    I'm forwarding this to our support system as we need to look into the log file, which contains sensitive information.

  • 0
    Dominik Britz

    Saad solved it on his own. Closing this.

Please sign in to leave a comment.