Deployment Monitor Missing Forwarders

[jdunlea_splunk]

The Missing Forwarders dashboard is telling me that there are x number of missing forwarders which "have not connected in the past 24 hours" - However when I check the detailed results, it tells me that the "last_connected" time for some of the forwarders, is indeed a time which is within 24 hours of the current time?

Can anyone help me out here as to why this is happening?

[andrewfoglesong]

Check the instance on the specific server. I've had Deployment Monitor flag a forwarder as down even with it reporting inside of the 24 hour window, just to find the forwarder daemon was indeed down. Searching the specific host "host=" for "Last 24 hour" may shed some light as to what's going on. In my previous case, the server would be churning out a steady amount of logs, then just stop for a couple hours. There may be a parameter within the Deployment Monitor searches that detects this.