https://community.splunk.com/t5/Getting-Data-In/Deployment-Monitor-Missing-Forwarders/m-p/92624#M19225 <P>The Missing Forwarders dashboard is telling me that there are x number of missing forwarders which "have not connected in the past 24 hours" - However when I check the detailed results, it tells me that the "last_connected" time for some of the forwarders, is indeed a time which is within 24 hours of the current time?</P> <P>Can anyone help me out here as to why this is happening?</P> Wed, 14 Mar 2012 23:37:44 GMT jdunlea_splunk 2012-03-14T23:37:44Z https://community.splunk.com/t5/Getting-Data-In/Deployment-Monitor-Missing-Forwarders/m-p/92624#M19225 <P>The Missing Forwarders dashboard is telling me that there are x number of missing forwarders which "have not connected in the past 24 hours" - However when I check the detailed results, it tells me that the "last_connected" time for some of the forwarders, is indeed a time which is within 24 hours of the current time?</P> <P>Can anyone help me out here as to why this is happening?</P> Wed, 14 Mar 2012 23:37:44 GMT https://community.splunk.com/t5/Getting-Data-In/Deployment-Monitor-Missing-Forwarders/m-p/92624#M19225 jdunlea_splunk 2012-03-14T23:37:44Z https://community.splunk.com/t5/Getting-Data-In/Deployment-Monitor-Missing-Forwarders/m-p/92625#M19226 <P>Check the instance on the specific server. I've had Deployment Monitor flag a forwarder as down even with it reporting inside of the 24 hour window, just to find the forwarder daemon was indeed down. Searching the specific host "host=<HOSTNAME>" for "Last 24 hour" may shed some light as to what's going on. In my previous case, the server would be churning out a steady amount of logs, then just stop for a couple hours. There may be a parameter within the Deployment Monitor searches that detects this. </HOSTNAME></P> Tue, 29 Oct 2013 19:06:27 GMT https://community.splunk.com/t5/Getting-Data-In/Deployment-Monitor-Missing-Forwarders/m-p/92625#M19226 andrewfoglesong 2013-10-29T19:06:27Z