https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261099#M50084 <P>There is a scheduled search called "DMC Forwarder - Build Asset Table" that populates that lookup table. You can manually build the forwarder assets table by going to the DMC App then the "Settings" &gt; "Forwarder Monitoring Setup" page and clicking on the "Rebuild Forwarder Assets" button. </P> Tue, 02 Feb 2016 18:19:44 GMT anshu 2016-02-02T18:19:44Z https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261098#M50083 <P>In the Distributed Management Console, there is a pre-built alert called "DMC Alert - Missing forwarders", and inside the alert is the search string:</P> <PRE><CODE>| inputlookup dmc_forwarder_assets | search status="missing" | rename hostname as Instance </CODE></PRE> <P>I actually looked inside of the lookup table and it is empty. Does anyone know how Splunk populates this lookup table? </P> <P>Or does anyone have a better solution using some other tools to send alerts/reports once there has been more than 24 hours since the forwarder last contacted/phoned home with Splunk?</P> <P>Thanks</P> Tue, 02 Feb 2016 14:35:22 GMT https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261098#M50083 prtlin 2016-02-02T14:35:22Z https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261099#M50084 <P>There is a scheduled search called "DMC Forwarder - Build Asset Table" that populates that lookup table. You can manually build the forwarder assets table by going to the DMC App then the "Settings" &gt; "Forwarder Monitoring Setup" page and clicking on the "Rebuild Forwarder Assets" button. </P> Tue, 02 Feb 2016 18:19:44 GMT https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261099#M50084 anshu 2016-02-02T18:19:44Z https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261100#M50085 <P>Hi @prtlin</P> <P>What is the name of the pre-built alert you were referring to in your post? You said:</P> <P><EM>pre-built alert called ""</EM></P> <P>but I'm not sure if you accidentally deleted what was inside the double quotes when you originally posted your question.</P> Tue, 02 Feb 2016 23:20:22 GMT https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261100#M50085 ppablo 2016-02-02T23:20:22Z https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261101#M50086 <P>DMC Alert - Missing forwarders</P> Wed, 03 Feb 2016 14:15:31 GMT https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261101#M50086 prtlin 2016-02-03T14:15:31Z https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261102#M50087 <P>prtlin, I updated my answer to include a manual method for building the forwarder assets table. Were you able to get the lookup table populated? </P> Thu, 11 Feb 2016 17:56:31 GMT https://community.splunk.com/t5/Getting-Data-In/Distributed-Management-Console-How-to-monitor-and-alert-if/m-p/261102#M50087 anshu 2016-02-11T17:56:31Z