Hi @kajalchopade071,
you can check if a Forwarder is running searching in _internal index, something like this:
index=_internal host=your_host
if you have results, Forwarder is up and running.
To check if a Forwarder is sending a kind of logs, you have to do the same thing in the index containing the logs to check.
if you have many hosts to monitor, you have to create a lookup (called e.g. perimeter.csv), containing all the hosts to monitor (e.g. in a column called host) and run a little more comples search:
| metasearch index=_internal
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0
Ciao.
Giuseppe
