How to get Splunk UF versions in Intermediate forwarder set up?

[dmcintosh1972]

Hi can anyone think of a way to get Splunk versions reported from universal forwarders when in a Intermediate forwarder environment.

I have tried searches like 

index=_internal sourcetype=splunkd group=tcpin_connections
but it only returns the agent version of the intermediate layer, not the UF versions behind it.

Are there any commands that can be deployed via to each UF to collect that information?

[dmcintosh1972]

Hi

FYI

limits.conf
[metrics:tcpin_connections]
aggregate_metrics = true

this setting will aggregate the data being received on the Intermediate forwarders so does not report the individual servers.

[dmcintosh1972]

thanks for your help, not sure if i need to enable something. to log more metrics?
from UF i only see the group fields per_host_thruput, instance.

The group=tcpin_connections are only logged under my cloud indexers and the hostnames covered are the cloud infrastructure and the IUF's, now other UF servers.

[richgalloway · Accepted solution]

The intermediate forwarders should be logging the tcpin_connection events they get from UFs (at least if they're heavy forwarders).  Check that they are forwarding their logs

[isoutamo]

UFs are reporting their version just like IUFs, just check/add their name to your query.