i need to trigger alert when the splunkforwarder is down for the particular index
have a look at this answer.
https://answers.splunk.com/answers/108260/alert-or-show-when-a-host-is-down-from-any-index.html