topic What forwarder versions am I running? in Splunk Search

What forwarder versions am I running?

the_wolverine — Fri, 05 Feb 2010 03:01:22 GMT

Is there a search that I can run at the indexer that will tell me what versions my forwarders are on?

Re: What forwarder versions am I running?

Mick — Sat, 06 Feb 2010 06:36:35 GMT

No, but there are plans to do this in a future version

Re: What forwarder versions am I running?

the_wolverine — Fri, 02 Apr 2010 12:27:18 GMT

The capability was added in 4.0.10 (forwarders) to forward on the license.version file. As a workaround for pre-4.0.10 forwarders, you can configure the following input on your forwarder's inputs.conf:

[monitor://$SPLUNK_HOME/etc/splunk.version]
index = _internal
host=myLWF1
sourcetype=splunk_version
_TCP_ROUTING = *

This will forward the splunk.version file to your indexer. You can then easily figure out what version each forwarder host is running by searching on the LWF hostname and sourcetype=splunk_version.

Re: What forwarder versions am I running?

gkanapathy — Fri, 02 Apr 2010 21:27:26 GMT

This is in 4.0.10. release, so if you are there, you don't need to add it.

Re: What forwarder versions am I running?

ben_leung — Wed, 04 Jun 2014 21:44:17 GMT

Hello from the future/present.....past....

Is there now a splunk query to run at the indexer level to display forwarder versions?