How to report on how many deployed hosts are actually forwarding data, and if not, report when they last sent data?

[cbright]

For instance I have 1400 forwarders with the Windows TA app deployed but am trying to find which ones are not reporting at all and how many stopped reporting in the last few days.

[wrangler2x]

I use this search to check my forwarders every day.

index="summary_forwarders" NOT sourceHost="127.0.0.1" | stats count by sourceHost sourceIp connectionType version build lastConnected  | eval lastConnected=strftime(lastConnected,"%m/%d/%Y %H:%M:%S") | fields sourceHost sourceIp connectionType version build lastConnected | dedup 1 sourceHost sortby -lastConnected | eval sourceHost=lower(sourceHost) | sort sourceHost

I always make a note of the count. If in a subsequent day I see a lower count, I know something has gone missing.

[raja8220]

I dont have the summary_forwarders index ?

[dflodstrom]

Good question! Relying on the forwarder management dashboards isn't practical.