Currently, we are using null queue settings on nearly 100+ servers. All the packets will get dropped at forwarders. We have violated the license a couple of times, so instead of uninstalling agents, we are using nullqueue.
We need to find the total number of events dropped at the Forwarder, so that we can procure the license and for future capacity planning. Any thoughts?