I'm using below query for check the which server/devices are not reporting to Splunk. | metadata index=windows OR index=wineventlog type=hosts | eval age = now()-lastTime | where age > (2*86400) | convert ctime(lastTime) | fields age,host,lastTime ... View more