https://community.splunk.com/t5/Getting-Data-In/How-to-identify-Lightweight-Forwarders-vs-Universal-Forwarders/m-p/24224#M3810 <P>Great. This also works in 4.2, and contains hostnames instead of IPs (in our environment at least): <CODE>index=_internal source=fwd | dedup hostname | table hostname, ssl, lastIndexer, fwdType</CODE></P> Thu, 09 Jun 2011 13:16:25 GMT Jason 2011-06-09T13:16:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-identify-Lightweight-Forwarders-vs-Universal-Forwarders/m-p/24222#M3808 <P>I'm dealing with an environment of mixed Lightweight Forwarders and Universal Forwarders. How can I tell, without logging into the forwarders, which is running what?</P> <P>The build number for LWF/main package of Splunk is confusingly identical to that of the UF.</P> Tue, 07 Jun 2011 18:13:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-identify-Lightweight-Forwarders-vs-Universal-Forwarders/m-p/24222#M3808 Jason 2011-06-07T18:13:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-identify-Lightweight-Forwarders-vs-Universal-Forwarders/m-p/24223#M3809 <P>Try this:</P> <PRE><CODE>index=_internal source=*metrics.log group=tcpin_connections | dedup sourceHost, sourceIp | table sourceHost, sourceIp, ssl, lastIndexer, fwdType </CODE></PRE> Tue, 07 Jun 2011 20:33:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-identify-Lightweight-Forwarders-vs-Universal-Forwarders/m-p/24223#M3809 mw 2011-06-07T20:33:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-identify-Lightweight-Forwarders-vs-Universal-Forwarders/m-p/24224#M3810 <P>Great. This also works in 4.2, and contains hostnames instead of IPs (in our environment at least): <CODE>index=_internal source=fwd | dedup hostname | table hostname, ssl, lastIndexer, fwdType</CODE></P> Thu, 09 Jun 2011 13:16:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-identify-Lightweight-Forwarders-vs-Universal-Forwarders/m-p/24224#M3810 Jason 2011-06-09T13:16:25Z