Hi. I have uberAgent installed on 1200+ endpoints (laptops) across my company, all of them forwarding data to splunk. uberAgent is sending data to a locally installed splunk universal forwarder on every endpoint via port 19500.
Now the problem is, some of the uberAgent datamodels are not being populated by data from all the endpoints. For e.g. "uberAgent.Application_ApplicationUsage" datamodel is only capturing data from ~650 endpoints, same is the case with "uberAgent.System_NetworkConfigInformation". All other datamodels are working fine. The endpoints are all configured similarly and there is no difference in OS/hardware as well. Any leads on how to troubleshoot this?
Cheers
Saad
