Not sure how this is working

[cboillot]

Please correct me if I am wrong: With a quick look over, it appears that these does nothing more than what can be done with a spreadsheet. I am not seeing where this pulls any actual data from Splunk.

Do we have to count the forwarders and manually update?

[niketn]

@cboillot I would suggest either contact the developer or better try the
Chargeback Analysis for Splunk app from Splunkbase built by Splunk works.