if I correctly understood your need, you have:
at first to identify these flows (e.g. they are in one index or they have a known sourcetype),
then create a lookup (called e.g. perimeter.csv) containing all the target server to monitor (at least one column called e.g. host);
then run a search like this:
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup your_lookup.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0
Thanks, the hard part is locating what is "custom". Do you know of a query that might return a list of "custom" data inputs? Or, a way to list "default" data inputs and then use that as a list to determine what is "custom"...thanks again for your help!
if a UF is managed by the Deployment Server, you cannot have custom apps.
So custom inputs can be only in %SPLUNK_HOME/etc/system/local.
At this point you can use a remote script to check them or, using Splunk, you could create and deploy an input that takes all the inputs.conf that are in %SPLUNK_HOME/etc/system/local folder
Something like this: