Run search to determine if forwarder has splunkweb enabled?

[muebel]

Is there a search string that would report on the status of splunkweb on each forwarding host?

[gkanapathy]

Not exactly. You could check for the existence and most recent time of a startup message in the Splunk internal web_service.log file, though a LWF may or may not forward that file. Though of course, a LWF shouldn't have SplunkWeb enabled at all.

index=_internal source=*web_service.log "ENGINE: Bus STARTED" | stats first(_time) by host

[muebel]

It looks like you would have to set the forwarder to monitor the web_service.log, or otherwise forward the contents of the forwarders _internal index. As far as I can tell, searching as you suggested will only return information for the indexers web_service.log, unless I am missing something.