https://community.splunk.com/t5/Splunk-Enterprise/How-to-check-Universal-Forwader-version-in-Splunk-Enterprise/m-p/690937#M19634 <P>I assume the answer is to check Forwader management on setting or to check Forwader Deployment: in monitoring console.<BR /><BR />Is there any other way?</P> Tue, 18 Jun 2024 01:30:41 GMT MK2 2024-06-18T01:30:41Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-check-Universal-Forwader-version-in-Splunk-Enterprise/m-p/690937#M19634 <P>I assume the answer is to check Forwader management on setting or to check Forwader Deployment: in monitoring console.<BR /><BR />Is there any other way?</P> Tue, 18 Jun 2024 01:30:41 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-check-Universal-Forwader-version-in-Splunk-Enterprise/m-p/690937#M19634 MK2 2024-06-18T01:30:41Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-check-Universal-Forwader-version-in-Splunk-Enterprise/m-p/690941#M19635 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/269120">@MK2</a>&nbsp;the monitoring console is ostensibly the best place to check your forwarder versions, although keep in mind all the data there is populated by internal Splunk searches, so you can actually search the data yourself if you need a different visualization, for example.<BR /><BR />E.g.</P><LI-CODE lang="markup">index="_internal" source="*metrics.lo*" group=tcpin_connections | dedup guid| eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="uf","universal forwarder", fwdType=="lwf", "lightweight forwarder",fwdType=="full", "heavy forwarder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk forwarder", connectionType=="raw" or connectionType=="rawSSL","legacy forwarder")| eval build=if(isnull(build),"n/a",build) | eval version=if(isnull(version),"pre 4.2",version) | eval guid=if(isnull(guid),sourceHost,guid) | eval os=if(isnull(os),"n/a",os)| eval arch=if(isnull(arch),"n/a",arch) | table sourceHost connectionType sourceIp sourceHost ssl ack build version os arch guid</LI-CODE> Tue, 18 Jun 2024 03:03:01 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-check-Universal-Forwader-version-in-Splunk-Enterprise/m-p/690941#M19635 KendallW 2024-06-18T03:03:01Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-check-Universal-Forwader-version-in-Splunk-Enterprise/m-p/690947#M19637 <P>Thank you for your commentary.<BR />I appriciate it.</P> Tue, 18 Jun 2024 04:42:32 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-check-Universal-Forwader-version-in-Splunk-Enterprise/m-p/690947#M19637 MK2 2024-06-18T04:42:32Z