https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/608669#M105589 <P>Hi</P><P>FYI</P><P>limits.conf<BR />[metrics:tcpin_connections]<BR />aggregate_metrics = true</P><P>this setting will aggregate the data being received on the Intermediate forwarders so does not report the individual servers.</P> Mon, 08 Aug 2022 10:46:23 GMT dmcintosh1972 2022-08-08T10:46:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/607787#M105495 <P>Hi can anyone think of a way to get Splunk versions reported from universal forwarders when in a Intermediate forwarder environment.</P> <P>I have tried searches like&nbsp;</P> <P>index=_internal sourcetype=splunkd group=tcpin_connections<BR />but it only returns the agent version of the intermediate layer, not the UF versions behind it.</P> <P>Are there any commands that can be deployed via to each UF to collect that information?</P> Mon, 01 Aug 2022 19:45:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/607787#M105495 dmcintosh1972 2022-08-01T19:45:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/607802#M105497 <P>The intermediate forwarders should be logging the tcpin_connection events they get from UFs (at least if they're heavy forwarders).&nbsp; Check that they are forwarding their logs</P> Mon, 01 Aug 2022 16:54:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/607802#M105497 richgalloway 2022-08-01T16:54:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/607804#M105498 <P>UFs are reporting their version just like IUFs, just check/add their name to your query.</P> Mon, 01 Aug 2022 17:18:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/607804#M105498 isoutamo 2022-08-01T17:18:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/607819#M105502 <P>thanks for your help, not sure if i need to enable something. to log more metrics?<BR />from UF i only see the group fields per_host_thruput, instance.</P><P>The&nbsp;group=tcpin_connections are only logged under my cloud indexers and the hostnames covered are the cloud infrastructure and the IUF's, now other UF servers.</P> Mon, 01 Aug 2022 19:39:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/607819#M105502 dmcintosh1972 2022-08-01T19:39:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/608669#M105589 <P>Hi</P><P>FYI</P><P>limits.conf<BR />[metrics:tcpin_connections]<BR />aggregate_metrics = true</P><P>this setting will aggregate the data being received on the Intermediate forwarders so does not report the individual servers.</P> Mon, 08 Aug 2022 10:46:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Splunk-UF-versions-in-Intermediate-forwarder-set-up/m-p/608669#M105589 dmcintosh1972 2022-08-08T10:46:23Z