I have a slightly different requirement where the missing forwarders would blow out due to constantly changing Citrix clients, so my first comment below about dismissing the "DMC Forwarder - Build Asset Table" is because its appending to the existing table.
If you check the Job Activity page on the Monitoring Console you will see two jobs that show up:
The first is scheduled to run every 15 minutes and can be ignored.
The second is the job that is initiated when you "Rebuild forwarder assets" (previous 24 hours defines the 48m sparkline argument), this is what we are interested in.
If you follow the bouncing ball you can figure out what it's doing yourself, to get you started:
The role can be tightend and given just the below:
Restrict search terms: index=_internal sourcetype=splunkd
Capabilities: admin_all_objects, output_file, search
Available search indexes: _internal
I kept running into permission issues unless I gave the "admin_all_objects" capabilitiy. Not sure if I missed something or if this is due to some Monitoring Console magic.
The capabilities above are fairly locked down, so I feel like it is a reasonable compromise.
To rebuild the forwarder asset table, you simply have to run the "DMC Forwarder - Build Asset Table" saved search with earliest and latest times that cover the lookback period that you want to consider.