I'm using below query for check the which server/devices are not reporting to Splunk.
| metadata index=windows OR index=wineventlog type=hosts | eval age = now()-lastTime | where age > (2*86400) | convert ctime(lastTime) | fields age,host,lastTime
If you are using forwarders to send logs to the Indexer, I would say just to use the Deployment Monitor app, to check up this. It will tell you the last update received from the forwarders, so you would be able to gauge from their which need to be check up on.
Hope this helps.