i want to know the list of splunk forwarders which are not phoned home from last month so that we can take appropriate action against them in our environment
I recommend you use the Management Console (aka DMC) to report on the status of your forwarders. The Monitoring Console allows you to see the overall status of all your forwarders (active/missing) and can even alert on missing forwarders.
https://answers.splunk.com/answers/525446/search-query-to-check-50-100-forwarders-phoning-ho.html
Also have a look at below answers:
... newer answer...
https://answers.splunk.com/answers/319970/what-options-are-there-to-find-if-a-forwarder-has.html
...older answers...
https://answers.splunk.com/answers/798/how-do-i-tell-if-a-forwarder-is-down.html
Another workaround is :
Get a list of clients and import in Splunk as a lookup.Run a query which will give you a list of phoning of clients in Splunk and do inputlookup
and find what all clients are not thereby comparing the lookup.
I think this should give you list of phoning home clients !
| rest /services/deployment/server/clients | table title | rename title as hostname | eval state="phonehome"
let me know if this helps!