topic Re: Determine Universal Forwarder vs Other Forwarder from Logs in Getting Data In

Determine Universal Forwarder vs Other Forwarder from Logs

David — Fri, 11 Apr 2014 23:24:37 GMT

I know that you can run splunk version to get an output telling you whether a Splunk install has the UF binaries or the full binaries, but is there ever anything logged? I did a search of my $SPLUNK_HOME/var/log/splunk and didn't find the word "universal" anywhere.

Re: Determine Universal Forwarder vs Other Forwarder from Logs

mcmaster — Sat, 12 Apr 2014 00:16:53 GMT

Try this search:

index=_internal fwdtype sourcetype=splunkd component=Metrics | table host fwdType | dedup host

I've never run that search before today, but it appears based on our systems to log "uf" for Universal Forwarders and "full" for a Splunk Enterprise install.

Hope that helps.