I've been been given 2 tasks with regards to our Splunk forwarders.
1) Find out which forwarders are not checking in/do not have a heartbeat but have in the past.
2) Find out which forwarders do have a live heartbeat but have not sent any logs in over a specific period of time (probably going to make it 4 hours)
Could anyone give me advise on how I would go about finding this information? I have looked into creating a daily alert or report to inform me but I don't have a clue where I should be searching.
Any help at all would be appreciated as I don't even know where to start with this.