Thanks for helping everyone! Unfortunately I'm still running version 6.2 so I can't use the DMC until I upgrade to 6.3.. But I did come up with a temporary solution to monitor my forwarders until I upgrade Splunk..
I used the search below to list all my forwarders, I then saved the search as an alert and set the timespan to check every 5 minutes and set the "Trigger if number of results != 249".. I tested this by stopping one of the forwarders and sure enough it sent an alert saying a forwarder is down.
The only drawback to this is if we add another forwarder I then have to update the hard coded value in the alert settings, but this is only temporary so it will work for now.
index=_internal sourcetype=splunkd destPort!="-"
| stats sparkline count by hostname, sourceHost, host, destPort, version
| rename destPort as "Destination Port"
| rename host as "Indexer"
| rename sourceHost as "Forwarder IP"
| rename version as "Splunk Forwarder Version"
| rename hostname as "Forwarder Host Name"
| rename sparkline as "Traffic Frequency"
| sort - count
... View more