Our organization currently hosts a "Splunk Health" dashboard. This dashboard has a panel that shows the heartbeat interval and overdue status of all the known splunk forwarders. However, what this dashboard does not have is a panel that can identify any valid endpoint on network that does not have the splunk forwarder installed. Problem Statement: Add panel to dashboard that depicts any valid endpoint without Splunk forwarder installed. I am fairly new to splunk. However, I thought that the best way to tackle would be to pull a csv from AD of all valid endpoints (WS, Servers, etc) and host as a lookup table file within Splunk. Then identify a query that compare current "clients" in Forwarder Management against the new lookup table file (AD output). The results would show me any endpoint that is not currently a client within Forwarder Management. Any help would be appreciated. Thank you. ... View more