How to write a search to display forwarders missing at a certain point in time?

[AaronMoorcroft]

Hi Guys

Is there a search that can pull back the forwarders that are missing / not sending data at a point in time, so if 100 were reporting in yesterday, I'm after a report that looks at what's sending logs now and compare to what was sending in at the same time yesterday and display the missing forwarders at this point in time.

I hope that makes sense.

Thanks

[skoelpin]

Try this

index=_internal sourcetype=splunkd destPort!="-"| stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count

[AaronMoorcroft]

Hey, thank you.

That's not quite what I need but it will help me with a different task I have so thank you 🙂