Is there a query for the indexers to find the nosiest forwarders in the last 24 hours?

[mattholt]

We need to find the most talkative indexers within Splunk for the last 24 hour period.

[renjith_nair]

This might help you to find the amount of data sent by forwarders

index=_internal sourcetype=splunkd group=per_host_thruput earliest=-24h| stats sum(kb) as total by series|rename seties as Host|sort - total