I've pieced together some SPL that shows me the last time the forwarder has sent its log data, but need to convert the | eval Hour =relative_time(_time,"@h") to normal date-time format, i.e. HH:MM:SS. Any help is greatly appreciated!
index=_internal sourcetype=splunkd group=tcpin_connections component=Metrics
| eval sourceHost=coalesce(hostname, sourceHost)
| rename connectionType as connectType
| eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder")
| fillnull version value="pre 4.2"
| rename version as Ver arch as MachType
| fields _time,connectType sourceIp sourceHost destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server Ver MachType
| eval Indexer= splunk_server
| eval Hour=relative_time(_time,"@h")
| stats avg(tcp_KBps) as avg_TCP_KBps avg(tcp_eps) as avg_TCP_eps sum(kb) as total_KB by Hour connectType sourceIp sourceHost MachType destPort Indexer Ver