How to write a search to return the number of forwarders that have reported within the last hour?

[AaronMoorcroft]

Hi Guys

So what I'm looking for is the search from the Deployment Monitor app that shows the All Forwarders section in just number, let me explain.

I would like to add a new panel to an existing dashboard that shows a number of all the forwarders that have reported in over say the last hour. This is for a basic morning checks dashboard. Is there anyone that can help me with this ?

Cheers

Aaron

[richgalloway · Accepted solution]

This should get you started:

index=_internal source=*metrics.log* group=tcpin_connections | stats dc(hostname) by fwdType

[AaronMoorcroft]

That Sir will just about do what I need, Thank You 🙂