What alert search can I use to check and alert on a HF not forwarding any data.

[JTS911]

Is there a heart beat from the HF I can monitor and if not detected, alert on it ? 

[JTS911]

Used this to find the HF's 

| set diff [search earliest="-30m" index=_internal host="*-splunk-hf"
| dedup host
| table host] [search earliest="-10m" index=_internal host="*-splunk-hf"
| dedup host
| table host]

[richgalloway · Accepted solution]

The Monitoring Console can do that for you.

There are a number of events you can use as a heartbeat.  Search the internal index for one your forwarder's names to find them.