Hi, is there any solution to create a notable event for missing forwarders? Now missing forwarders generate an alert on Monitoring Console, which runs on a separate Splunk instance than ES.
You can write a correlation search for missing forwarders and select the alert type as a notable event.And you will get all the missing forwarder alerts as a notable event.
