I'm looking for a way to report/alert anytime a new forwarder is added to my deployment server. I've tried searching on internal with the following search, but this isn't unique to when a forwarder is initially added to our environment.
index=_internal sourcetype=splunkd component=PubSubSvr host=
↧