I'd start by making sure the forwarders are connecting to the indexers, not just the deployment server.
index=_internal source=*metrics.log* tcpin_connections | stats count by sourceIp
You should see connections from the forwarders and if they are connected you should also be able to search _internal for each host since they should be forwarding internal data. If they aren't connected I would check your outputs deployed to the forwarders.
If they are connecting, just not sending the Windows data you are expecting I would check the monitor on the forwarder. On a forwarder you can run "./splunk list monitor" to see which files it is trying to monitor and forward. If what you are looking for isn't listed I'd check the deployment server for the app that defines the inputs and make sure the app is set to trigger a restart when updated. It could be possible the app was deployed but Splunk was not restarted and the forwarder has not yet loaded in the inputs.
... View more