I have been going through some of the searches in Deployment Monitor. I would like to get an idea on the health of our forwarders. I see the macros for all_forwarders which expands out to a nice long search. part of that search includes the following:
| eval status = if(isnull(KB) or lastConnected<(info_max_time-900),"missing", if(mystatus="quiet","quiet","active"))
Where does info_max_time and mystatus get set? I search through the whole deployment monitor directory and don't find anything.