https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41336#M7685 <P>Thanks Vlad.</P> <P>One more way of doing this..</P> <P>| metadata index=index* OR index=main type=hosts | eval age = now()-lastTime | where age &lt; 432000| sort age d | convert ctime(lastTime) | fields age,host,lastTime</P> <P>Above search returns new forwarders added in the last 5 days.</P> Fri, 12 Aug 2011 14:00:44 GMT amN0P 2011-08-12T14:00:44Z https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41334#M7683 <P>Is there a way of triggering an automated email alert whenever a NEW host(forwarder) starts sending logs to the Splunk Server.</P> Tue, 12 Jul 2011 13:39:53 GMT https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41334#M7683 amN0P 2011-07-12T13:39:53Z https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41335#M7684 <P>Maybe it's not a right way but I used some similar query for alarm to check if I "lost" some hosts</P> <PRE><CODE>index=my_index host earliest=-5m latest=now | dedup host | eval StatusBefore=1 | join type=left host [search index=my_index host earliest=-65m latest=-60m | dedup host | eval StatusNow=1 ] | eval Status=if(StatusBefore=StatusNow,1,0) | table host, Status | where Status=0 </CODE></PRE> <P>This query do:</P> <UL> <LI>check available hosts for last 5 minutes</LI> <LI>check available hosts for 5 minutes - 1 hour</LI> <LI>compare two results (status = 1 - OK, status = 0 - new host)</LI> </UL> <P>Depending on your data polling interval you can set your own periods.</P> Wed, 13 Jul 2011 10:13:39 GMT https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41335#M7684 Vladimir 2011-07-13T10:13:39Z https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41336#M7685 <P>Thanks Vlad.</P> <P>One more way of doing this..</P> <P>| metadata index=index* OR index=main type=hosts | eval age = now()-lastTime | where age &lt; 432000| sort age d | convert ctime(lastTime) | fields age,host,lastTime</P> <P>Above search returns new forwarders added in the last 5 days.</P> Fri, 12 Aug 2011 14:00:44 GMT https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41336#M7685 amN0P 2011-08-12T14:00:44Z https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41337#M7686 <P>Doesn't this show all forwarders <EM>that have logged</EM> in the past 5 days?</P> Thu, 17 Dec 2015 14:10:32 GMT https://community.splunk.com/t5/Getting-Data-In/New-Forwarder-Added/m-p/41337#M7686 reedmohn 2015-12-17T14:10:32Z